CVE-2026-25499: Proxmox Provider Path Traversal Flaw

CVE-2026-25499 Overview

A path traversal vulnerability has been identified in the Terraform/OpenTofu Provider for Proxmox Virtual Environment. Prior to version 0.93.1, the SSH configuration documentation recommends an insecure sudoer line configuration that enables attackers to escape the intended directory using ../ sequences. This flaw allows unauthorized modification of arbitrary files on the system, potentially leading to complete system compromise.

Critical Impact

This path traversal vulnerability allows attackers to escape restricted directories and edit any files on the system, potentially enabling privilege escalation, configuration tampering, or deployment of malicious code in infrastructure-as-code environments.

Affected Products

• Terraform Provider for Proxmox Virtual Environment versions prior to 0.93.1
• OpenTofu Provider for Proxmox Virtual Environment versions prior to 0.93.1

Discovery Timeline

• 2026-02-04 - CVE-2026-25499 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25499

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a common security weakness where user-controllable input is used to construct file paths without proper validation. In this case, the insecure sudoer configuration recommended in the SSH documentation fails to restrict directory traversal sequences, allowing attackers to navigate outside the intended working directory.

The vulnerability has a network-based attack vector, meaning it can be exploited remotely without requiring any authentication or user interaction. The primary impact is on system integrity, as attackers can modify arbitrary files on the target system. This is particularly dangerous in infrastructure-as-code environments where Terraform/OpenTofu providers manage critical infrastructure components.

Root Cause

The root cause stems from an insecure sudoer line configuration suggested in the provider's SSH documentation. The recommended configuration did not properly sanitize or restrict file path inputs, allowing relative path sequences like ../ to traverse outside the intended directory boundaries. This documentation-level security oversight propagated to any deployments following the official configuration guidance.

Attack Vector

The attack exploits the path traversal weakness by injecting directory traversal sequences (../) into file path parameters. When the sudoer configuration processes these paths without proper validation, the attacker can navigate to arbitrary locations in the filesystem. This enables reading or writing to sensitive system files, configuration files, or deploying malicious scripts that execute with elevated privileges.

An attacker with network access to a vulnerable Proxmox environment configured following the insecure documentation could craft requests containing traversal sequences to access files outside the intended scope. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-25499

Indicators of Compromise

• Unusual file access patterns in system logs showing ../ sequences in file paths
• Unexpected modifications to system configuration files outside the Proxmox provider's working directory
• SSH session logs indicating traversal attempts against the sudoer configuration
• Changes to critical files like /etc/passwd, /etc/sudoers, or SSH authorized_keys files

Detection Strategies

• Monitor file system access logs for path traversal patterns such as ../, ..%2f, or encoded variants
• Implement file integrity monitoring (FIM) on critical system files to detect unauthorized modifications
• Review Terraform/OpenTofu execution logs for suspicious file path parameters
• Deploy runtime application self-protection (RASP) to detect and block traversal attempts in real-time

Monitoring Recommendations

• Enable comprehensive audit logging on systems running the Proxmox provider
• Configure SIEM rules to alert on path traversal patterns in SSH and sudo logs
• Implement baseline monitoring for Terraform state files and configuration changes
• Monitor process execution for unexpected file operations in infrastructure automation contexts

How to Mitigate CVE-2026-25499

Immediate Actions Required

• Upgrade the Terraform/OpenTofu Provider for Proxmox to version 0.93.1 or later immediately
• Review and update any sudoer configurations that were implemented using the previous insecure documentation
• Audit systems for evidence of exploitation or unauthorized file modifications
• Restrict network access to Proxmox management interfaces where possible

Patch Information

The vulnerability has been addressed in version 0.93.1 of the terraform-provider-proxmox. The fix is available in the GitHub commit bd604c41a31e2a55dd6acc01b0608be3ea49c023. Organizations should update their provider version constraints and run terraform init -upgrade or the equivalent OpenTofu command to pull the patched version.

Workarounds

• Manually update the sudoer configuration to include proper path validation and restrictions
• Implement file system access controls to limit the provider's write access to specific directories
• Use containerization or sandboxing to isolate Terraform/OpenTofu execution environments
• Apply network segmentation to restrict access to infrastructure automation systems

# Update Terraform provider to patched version
terraform init -upgrade

# Verify the installed provider version
terraform version

# Review current sudoers configuration for insecure entries
sudo visudo -c