<p>There is no fixed version for <code>Centos:8</code> <code>libcurl-minimal</code>.</p>

Directory Traversal Affecting libcurl-minimal package, versions *

Snyk CVSS

Attack Complexity High

Threat Intelligence

EPSS 0.15% (51^st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-CENTOS8-LIBCURLMINIMAL-3366930
published 21 Mar 2023
disclosed 20 Mar 2023

Report a new vulnerability Found a mistake?

Introduced: 20 Mar 2023

CVE-2023-27534 Open this link in a new tab CWE-22 Open this link in a new tab

How to fix?

There is no fixed version for Centos:8 libcurl-minimal.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl-minimal package and not the libcurl-minimal package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.