CVE-2022-50917

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-50917
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50917.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50917
Published
2026-01-13T22:51:53.350Z
Modified
2026-07-15T01:49:21.636991132Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ProtonVPN 1.26.0 - Unquoted Service Path
Details

ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-428"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.26.0"
                },
                {
                    "last_affected": "1.26.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50917.json"
}
References

Affected packages

Git / github.com/protonvpn/win-app

Affected ranges

Type
GIT
Repo
https://github.com/protonvpn/win-app
Events
Introduced
765a8bfe017bafd5586fdbac5e39342a420c2ad6
Last affected
765a8bfe017bafd5586fdbac5e39342a420c2ad6
Database specific 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:proton:protonvpn:1.26.0:*:*:*:*:windows:*:*",
    "extracted_events": [
        {
            "introduced": "1.26.0"
        },
        {
            "last_affected": "1.26.0"
        }
    ]
}

Affected versions

1.*
1.26.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50917.json"