CVE-2023-27534

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.0.0

Description A path traversal vulnerability exists in the SFTP implementation of curl, where the tilde (~) character is wrongly replaced when used as a prefix in the first path element. This flaw can be exploited by attackers to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. The vulnerability allows for the circumvention of filtering or worse.

Recommendations For versions prior to 8.0.0, consider disabling the SFTP implementation until a patch is available. As a temporary workaround, avoid using the tilde (~) character as a prefix in the first path element when accessing servers via SFTP. Restrict access to SFTP servers to minimize the risk of exploitation.