CVE-2026-51080 identifies an XML External Entity (XXE) vulnerability in libpvestorage-perl version 9.1.1 and libpve-storage-perl version 8.3.7. XXE vulnerabilities occur when XML input containing a reference to an external entity is processed by a weakly configured XML parser, potentially allowing attackers to read local files, perform server-side request forgery, or cause denial of service. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

Successful exploitation of this XXE vulnerability could lead to full compromise of confidentiality, integrity, and availability of affected systems. Attackers may read sensitive files, execute unauthorized requests, or cause denial of service conditions. The critical CVSS score reflects the potential for severe impact without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting XML external entity processing in their XML parsers if possible, or apply other XML hardening measures specific to their environment.