curl · disclosed reports
File and Path Handling
21 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open curl on HackerOne- reports
- 21
- paid a bounty
- 0
Every one of the 21 is a mark on the map. Named now: 1 to 21, most upvoted first.
- [HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames
- Arbitrary File Read via file:// Protocol in cURL
- Directory Traversal Vulnerability in cURL via Content-Disposition Header Processing
- CVE-2026-80256: wcurl backslash bypass
- Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
- Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization
- 22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal
- libcurl FTP path normalization flaw allows decoded %2e%2e → CWD .. and directory escape (Path Traversal, CWE-22)
- Path Traversal in file:// protocol allows Arbitrary File Read
- curl External-Controlled Filename in `--url @file` Leads to Arbitrary File Overwrite
- Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCE
- arbitrary file read via `file://` path traversal with `--path-as-is`
- Arbitrary Configuration File Inclusion: via External Control of File Name or Path
- Vulnerability Report: Local File Disclosure via file:// Protocol in cURL
- Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File Exposure
- Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable
- inconsistently Rejection Logic in file:// URLs with Authority
- [High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)
- CVE-2026-111951: curl -OJ truncate without filename
- CVE-2023-27534: SFTP path ~ resolving discrepancy
- Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.