CVE-2026-25499 terraform-provider-proxmox has insecure sudo recommendation in the documentation
Insecure sudo documentation allows attackers to escape directories and modify arbitrary system files via path traversal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25499?
CVE-2026-25499 is a high-severity path traversal vulnerability in bpg terraform-provider-proxmox, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line suggested is insecure and can result in escaping the folder using ../, allowing any files on the system to be edited. This issue has been patched in version 0.93.1.
Which versions are affected by CVE-2026-25499?
3 open source packages ship an affected version, including github.com/bpg/terraform-provider-proxmox. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/bpg/terraform-provider-proxmox Go | All versions | 0.93.1 |
github.com/bpg/terraform-provider-proxmox Go | All versions | 0.93.1 |
github.com/bpg/terraform-provider-proxmox Go | All versions | 0.93.1 |
Products include Bpg Terraform Provider.
How do I fix CVE-2026-25499?
Upgrade github.com/bpg/terraform-provider-proxmox to 0.93.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25499 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25499 exists.
Sources
Also known as GHSA-gwch-7m8v-7544, GO-2026-4395.