curl: Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization

Summary: The dedotdotify function in lib/urlapi.c is responsible for removing path traversal sequences ../ and ./ from URLs according to RFC 3986. However, the function only recognizes literal forward slashes / when identifying path segments and does not handle URL-encoded slashes %2f or %2F. Thi...

PT-2025-72: Stack-based buffer overflow during POST-content decoding in LCD KVM over IP switch CL5708IM

The vulnerability was identified in LCD KVM over IP switch CL5708IM firmware version v2.2.215. The discovered vulnerability allows an attacker to achieve remote code execution or a denial‑of‑service. A stack‑based buffer overflow occurs during POST‑content decoding, enabling unauthenticated remot...