PT-2026-2393 · Proton Technologies · Protonvpn

Gemreda

·

CVE-2022-50917

·

Published

2026-01-13

·

Updated

2026-03-02

CVSS v4.0

8.5

High

VectorAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions ProtonVPN version 1.26.0
Description ProtonVPN version 1.26.0 has an issue with an unquoted service path in its WireGuard service configuration. This could allow local attackers to potentially run arbitrary code. The issue arises because of the unquoted path, enabling attackers to place malicious executables in specific file system locations. This allows them to gain higher privileges when the service starts.
Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2022-50917

Affected Products

Protonvpn