A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.
2023-03-30T20:15:07.427
2025-04-23T17:16:28.313
Modified
CVSSv3.1: 8.8 (HIGH)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | haxx | curl | ≤ 7.88.1 | Yes |
| Operating System | fedoraproject | fedora | 36 | Yes |
| Application | netapp | active_iq_unified_manager | - | Yes |
| Operating System | broadcom | brocade_fabric_operating_system_firmware | - | Yes |
| Operating System | netapp | h300s_firmware | - | Yes |
| Hardware | netapp | h300s | - | No |
| Operating System | netapp | h500s_firmware | - | Yes |
| Hardware | netapp | h500s | - | No |
| Operating System | netapp | h700s_firmware | - | Yes |
| Hardware | netapp | h700s | - | No |
| Operating System | netapp | h410s_firmware | - | Yes |
| Hardware | netapp | h410s | - | No |
| Application | splunk | universal_forwarder | < 8.2.12 | Yes |
| Application | splunk | universal_forwarder | < 9.0.6 | Yes |
| Application | splunk | universal_forwarder | 9.1.0 | Yes |