CVE-2022-50917

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-50917

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50917.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-50917

Published

2026-01-13T23:15:55.250Z

Modified

2026-04-10T04:55:53.464533Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path by placing malicious executables in specific file system locations to gain elevated privileges during service startup.

References

Affected packages

Git / github.com/protonvpn/win-app

Affected ranges

Type

GIT

Repo

https://github.com/protonvpn/win-app

Events

Introduced

Last affected

765a8bfe017bafd5586fdbac5e39342a420c2ad6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.26.0"
        }
    ]
}

Affected versions

1.*

1.23.4

1.24.0

1.24.1

1.24.2

1.25.0

1.25.2

1.26.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50917.json"