curl: [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames

Summary A malicious or MITM'd FTP server can cause a client using CURLOPTWILDCARDMATCH to download files outside the intended remote directory, by returning a LIST response with a filename containing .. path-traversal sequences. Details In the CURLWCDOWNLOADING state lib/ftp.c:4079-4095, each...