VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 30, 2023· Updated Apr 23, 2025

CVE-2023-27534

CVE-2023-27534

Description

A path traversal vulnerability in curl's SFTP implementation before 8.0.0 allows attackers to bypass filtering or execute arbitrary code via crafted paths using the tilde character.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A path traversal vulnerability in curl's SFTP implementation before 8.0.0 allows attackers to bypass filtering or execute arbitrary code via crafted paths using the tilde character.

Vulnerability

A path traversal vulnerability exists in curl's SFTP implementation in versions prior to 8.0.0. The tilde (~) character is incorrectly replaced when used as a prefix in the first path element, beyond its intended use to indicate a path relative to the user's home directory. This allows an attacker to craft a path like /~2/foo while accessing a server with a specific user, leading to unintended directory traversal.

Exploitation

An attacker needs network access to an SFTP server and the ability to supply a crafted path to curl. By constructing a path such as /~2/foo, the tilde expansion is misapplied, causing curl to resolve the path to an unexpected location. No authentication is required beyond the normal SFTP session credentials.

Impact

Successful exploitation can bypass path filtering mechanisms or lead to arbitrary code execution, depending on how the resolved path is used by the application or server. The attacker may gain access to files outside the intended directory or execute commands with the privileges of the SFTP user.

Mitigation

The vulnerability is fixed in curl 8.0.0 and later. Users should upgrade to at least curl 8.3.0-r2 as recommended by the Gentoo security advisory [2]. No workaround is available [2].

References
  1. Multiple Vulnerabilities (GLSA 202310-12) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

30

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

5

News mentions

0

No linked articles in our index yet.