PT-2026-6295 · Hashicorp+2 · Terraform+2

Lucasmaurice · CVE-2026-25499 · Published 2026-02-02 · Updated 2026-02-06

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Terraform / OpenTofu Provider versions prior to 0.93.1

Description The Terraform / OpenTofu Provider for Proxmox Virtual Environment, prior to version 0.93.1, contains an insecure sudoer line in its SSH configuration documentation. This configuration allows for potential path traversal using '../', enabling modification of any file on the system.

Recommendations Update to version 0.93.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-1188

CWE-22

Related Identifiers

CVE-2026-25499

GHSA-GWCH-7M8V-7544

GO-2026-4395

SUSE-SU-2026:0403-1

Affected Products

Opentofu

Proxmox Virtual Environment

Terraform

References · 88

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25499.json · Exploit
• 🔥 https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544 · Exploit
• https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023 · Patch
• https://osv.dev/vulnerability/GHSA-gwch-7m8v-7544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25499 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25499 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4395 · Vendor Advisory
• https://github.com/bpg/terraform-provider-proxmox · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note
• https://suse.com/security/cve/CVE-2026-24740 · Note
• https://suse.com/security/cve/CVE-2026-25499 · Note
• https://suse.com/security/cve/CVE-2026-23517 · Note