An insecure sudo recommendation in the documentation of the Terraform OpenTofu Proxmox Virtual Environment provider allows path traversal using "../", enabling a user to edit any file on the system. This flaw is based on path handling weaknesses (CWE-1188, CWE-22) and, if exploited, could allow an attacker to modify configuration files or scripts, potentially leading to arbitrary code execution or privilege escalation. The impact is limited to the system where the provider is executed, but the capability to edit arbitrary files is severe enough to allow compromise of critical components.

The vulnerability affects the Terraform/OpenTofu "terraform-provider-proxmox" supplied by bpg. Versions prior to 0.93.1 incorporate the insecure sudo recommendation in their SSH configuration documentation. Systems running this provider with a higher privileged environment that follows the documented sudo line are susceptible.

The CVSS score of 8.7 indicates high severity. EPSS is less than 1 percent, suggesting a very low probability of exploitation in the wild, and the issue is not listed in CISA's KEV catalog. The likely attack vector requires a user capable of executing the provider or modifying its configuration; the flaw is local to the provider's execution context and is mitigated by updating to a patched version.