CVE-2026-25499CWE-1188CWE-22

terraform-provider-proxmox has insecure sudo recommendation in the documentation

High · published February 4, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line suggested is insecure and can result in escaping the folder using ../, allowing any files on the system to be edited. This issue has been patched in version 0.93.1.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00551 · 45.4th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-02-04T20:31Z
EPSS history
Timeline
  • 04 FEB 20:31Z
    terraform-provider-proxmox has insecure sudo recommendation in the documentation
    cvelistv5