{"id":"CVE-2023-27534","title":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indic…","summary":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indic…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"haxx","product":"curl","affected":["curl >= 7.18.0, <= 7.88.1","fedora = 36","active_iq_unified_manager","brocade_fabric_operating_system_firmware","h300s_firmware","h500s_firmware","h700s_firmware","h410s_firmware","universal_forwarder >= 8.2.0, < 8.2.12","universal_forwarder >= 9.0.0, < 9.0.6","universal_forwarder = 9.1.0"],"patched":["universal_forwarder 9.0.6"],"published":"2023-03-30","updated":"2026-10-14","sourceUpdated":"2026-10-14T23:17:16.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","references":[{"url":"https://hackerone.com/reports/1892351","label":"support@hackerone.com"},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html","label":"support@hackerone.com"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","label":"support@hackerone.com"},{"url":"https://security.gentoo.org/glsa/202310-12","label":"support@hackerone.com"},{"url":"https://security.netapp.com/advisory/ntap-20230420-0012/","label":"support@hackerone.com"},{"url":"https://hackerone.com/reports/1892351","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202310-12","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20230420-0012/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-806742.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-27534.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-27534"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179069"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27534"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534"},{"url":"https://curl.se/docs/CVE-2023-27534.html"},{"url":"https://access.redhat.com/errata/RHSA-2023:3354"},{"url":"https://access.redhat.com/errata/RHSA-2023:6679"}],"tags":["nvd","csaf","vex","red-hat","cve.org","exploit-available","score-dispute"],"epss":0.0244,"epssPercentile":0.84216,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2025-04-23T13:29:22.277594Z"},"scores":{"nvd":8.8,"vendor":3.7,"adp":8.8},"ingestedAt":"2026-09-18T15:44:31.588Z","slug":"CVE-2023-27534","body":"## Overview\n\nA path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.\n\n## Affected\n\n- `curl >= 7.18.0, <= 7.88.1`\n- `fedora = 36`\n- `active_iq_unified_manager`\n- `brocade_fabric_operating_system_firmware`\n- `h300s_firmware`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h410s_firmware`\n- `universal_forwarder >= 8.2.0, < 8.2.12`\n- `universal_forwarder >= 9.0.0, < 9.0.6`\n- `universal_forwarder = 9.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `universal_forwarder 9.0.6`\n\n## Vendor advisories\n\n- **RHSA-2023:3354** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8 · released 2023-06-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:3354)\n- **RHSA-2023:6679** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2023-11-07 · [advisory](https://access.redhat.com/errata/RHSA-2023:6679)\n- **Red Hat VEX** · Low · affected: .NET Core 3.1 on Red Hat Enterprise Linux, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: .NET Core 3.1 on Red Hat Enterprise Linux, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-27534.json)","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":220523,"id":"CVE-2023-27534","ts":1792022566407,"field":"cvss","old":"3.7","new":"8.8"},{"seq":220522,"id":"CVE-2023-27534","ts":1792022566407,"field":"severity","old":"low","new":"high"},{"seq":208504,"id":"CVE-2023-27534","ts":1790005721392,"field":"cvss","old":"8.8","new":"3.7"},{"seq":208503,"id":"CVE-2023-27534","ts":1790005721392,"field":"severity","old":"high","new":"low"}]}