curl: FTP entrypath accepts 0xFF (Telnet IAC) through incomplete ISCNTRL filter, sent on wire via CWD on connection reuse

🗓️ 05 Apr 2026 06:46:27Reported by mzfrType

A malicious file transfer server can embed 0xFF in the PWD path and send it via CWD on connection reuse.

Reporter	Title	Published	Views	Family All 195
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2020-8284, CVE-2020-8285, and CVE-2020-8286)	15 Mar 202117:09	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: cURL libcurl vulnerabilites impacting Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint 4.0 and earlier (CVE-2020-8284, CVE-2020-8286, CVE-2020-8285)	4 Jun 202116:40	–	ibm
IBM Security Bulletins	Security Bulletin: cURL libcurl vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 4.0 and earlier (CVE-2020-8284, CVE-2020-8286, CVE-2020-8285)	4 Jun 202101:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by a vulnerability within libcurl (CVE-2020-8284)	19 May 202111:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (Multiple CVEs)	22 Apr 202212:50	–	ibm
FreeBSD	cURL -- Multiple vulnerabilities	9 Dec 202000:00	–	freebsd
ATTACKERKB	CVE-2020-8284	14 Dec 202020:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2021-1693)	6 Aug 202100:00	–	nessus