CVE-2023-27534

🗓️ 30 Mar 2023 00:00:00Reported by hackeroneType

cve🔗 web.nvd.nist.gov👁 321 Views🌐 WEB

Path traversal vulnerability in curl <8.0.0 SFTP implementatio

Reporter	Title	Published	Views	Family All 205
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Path Traversal in the RHEL UBI (CVE-2023-27534)	19 Jan 202421:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC	15 Jun 202317:06	–	ibm
IBM Security Bulletins	Security Bulletin: cURL as used by IBM QRadar WinCollect Agent contains multiple vulnerabilities	8 Jun 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Progress DataDirect Connect for ODBC	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in curl affects IBM Netezza Appliance	16 Apr 202610:52	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in cURL libcurl might affect IBM Spectrum Copy Data Management	15 Sep 202313:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in cURL libcurl affect AIX	29 Jun 202316:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MaaS360 Cloud Extender Agent, Mobile Enterprise Gateway, Configuration Utility, VPN, Certificate and Base Module affected by multiple vulnerabilities	6 Jun 202318:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by a libcurl vulnerability	25 Sep 202314:39	–	ibm

NVD

Vulners

Node

haxx curlRange7.18.0–7.88.1

Node

fedoraproject fedoraMatch36

Node

netapp active_iq_unified_managerMatch-vmware_vsphere

broadcom brocade_fabric_operating_system_firmwareMatch-

Node

netapp h300s_firmwareMatch-

AND

netapp h300sMatch-

Node

netapp h500s_firmwareMatch-

AND

netapp h500sMatch-

Node

netapp h700s_firmwareMatch-

AND

netapp h700sMatch-

Node

netapp h410s_firmwareMatch-

AND

netapp h410sMatch-

Node

splunk universal_forwarderRange8.2.0–8.2.12

splunk universal_forwarderRange9.0.0–9.0.6

splunk universal_forwarderMatch9.1.0

[
  {
    "vendor": "n/a",
    "product": "https://github.com/curl/curl",
    "versions": [
      {
        "version": "Fixed in 8.0.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2024/03/msg00016.html
security	www.security.gentoo.org/glsa/202310-12
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
hackerone	www.hackerone.com/reports/1892351
security	www.security.netapp.com/advisory/ntap-20230420-0012/

Parameter	Position	Path	Description	CWE
path	path	/~2/foo	Path traversal via tilde prefix in first path element of SFTP on curl < 8.0.0	CWE-22

17 Jun 2026 05:45Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

EPSS0.02195

CWE-22