Threats affecting pkg:github/bpg/terraform-provider-proxmox

CVE-2026-25499 is a high-severity vulnerability in the terraform-provider-proxmox prior to version 0.93.1, involving insecure default initialization of resources. The issue arises from an insecure sudoer line suggested in the SSH configuration documentation, which allows directory traversal via '.. /' sequences. This flaw enables attackers to edit arbitrary files on the system without authentication or user interaction. The vulnerability has a CVSS 4.0 score of 8.7, indicating a network-exploitable, high-impact issue affecting integrity. It has been patched in version 0.