PT-2026-6295 · Hashicorp+2 · Terraform+2

Lucasmaurice · Publicado 2026-02-02 · Atualizado 2026-02-06 · CVE-2026-25499

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Terraform / OpenTofu Provider versions prior to 0.93.1

Description The Terraform / OpenTofu Provider for Proxmox Virtual Environment, prior to version 0.93.1, contains an insecure sudoer line in its SSH configuration documentation. This configuration allows for potential path traversal using '../', enabling modification of any file on the system.

Recommendations Update to version 0.93.1 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-1188

CWE-22

Identificadores relacionados

CVE-2026-25499

GHSA-GWCH-7M8V-7544

GO-2026-4395

SUSE-SU-2026:0403-1

Produtos afetados

Opentofu

Proxmox Virtual Environment

Terraform

Referências · 88

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25499.json · Exploit
• 🔥 https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544 · Exploit
• https://github.com/bpg/terraform-provider-proxmox · Nota
• https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023 · Correção
• https://suse.com/security/cve/CVE-2026-24117 · Nota
• https://suse.com/security/cve/CVE-2023-43630 · Nota
• https://suse.com/security/cve/CVE-2026-23954 · Nota
• https://suse.com/security/cve/CVE-2026-24740 · Nota
• https://suse.com/security/cve/CVE-2026-25499 · Nota
• https://suse.com/security/cve/CVE-2026-23517 · Nota
• https://osv.dev/vulnerability/GHSA-gwch-7m8v-7544 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-24844 · Nota
• https://suse.com/security/cve/CVE-2026-25578 · Nota
• https://suse.com/security/cve/CVE-2026-23991 · Nota
• https://suse.com/security/cve/CVE-2026-25579 · Nota