I only tested via command line but qm does not have the -T switch on, so i did not see a security warning for the pciids read from sysfs. But the Web GUI runs with -T Changes since V1: - my $info = pci_device_info($pciid); + $pciid =~ m/^([:\.\d]+)$/ or die "PCI ID $pciid not valid!\n"; + my $info = pci_device_info($1);