CVE-2022-31358

Proxmox Virtual Environment has a reflected cross-site scripting flaw reachable via non-existent endpoints under /api2/html/: a crafted link to one of those bogus paths reflects attacker script back into the response, executing in the browser of a victim who follows it. What raises this above a routine XSS is the target — Proxmox VE is a hypervisor management console, so script running in an authenticated admin's session touches the control plane for whole fleets of virtual machines.

The vector shows the brakes and the amplifiers together: it needs low-privileged authentication and user interaction (an admin clicking the link), but the scope is changed and the impact spans confidentiality, integrity, and availability, reflecting that riding a virtualization admin's session is consequential. Realistically this is a targeted, phishing-delivered attack against a Proxmox operator rather than mass exploitation, but the payoff — acting within the session that manages the virtualization estate — is why it lands at the high end of XSS severity.

Our emphasis is exposure isolation and session protection for the management plane. Proxmox web UIs should never be broadly reachable, so we'd confirm any instance below v7.2-3 sits behind VPN or tight IP restrictions, shrinking the set of admins who could be lured while authenticated, and drive the upgrade on the hypervisor-management priority track. Where we can, watching for requests to the malformed /api2/html/ paths gives a clean detection signature while patching proceeds.