Vulnerability Report

CVE-2026-25499

Title: Insecure sudoer line in Terraform / OpenTofu Provider documentation

Arbitrary File Access

Proof Of Concept

No public PoC currently indexed for CVE-2026-25499.

CWE Category CWE-22

Published Date Feb 04, 2026

Modified Date Feb 11, 2026

Exploit Status Not Found

Score 8.7 CVSS v4.0

Exploit Probability (EPSS)

0.03%

Vulnerability Summary

CVE-2026-25499: Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line suggested is insecure and can result in escaping the folder using ../, allowing any files on the system to be edited. This issue has been patched in version 0.93.1.

Impacted Vendors

hashicorp 1

bpg 1

Reference Links

https://github.com/bpg/terraform-provider-proxmox/commit/bd604c41a31e2a55dd6acc01b0608be3ea49c023 https://github.com/bpg/terraform-provider-proxmox/security/advisories/GHSA-gwch-7m8v-7544

CVSS v4.0

Source Entity [email protected]

Severity HIGH

8.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1