Skip to content
Sign in

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:curl
Status
Severity
Weakness:File and Path Handling
Clear
Year
Bounty paid0
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters21 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches#4125257N/AFile and Path HandlingLow2026-10-20–2
CVE-2023-27534: SFTP path ~ resolving discrepancy#1892351ValidFile and Path HandlingLow2023-03-22–3
CVE-2026-111951: curl -OJ truncate without filename#4124849ValidFile and Path HandlingLow2026-10-26–4
[High] Arbitrary File Write via Path Traversal in cURL CLI (`-o`, `--output`) (CWE-22: Improper Limitation of a Pathname to a Restricted Directory)#3120987N/AFile and Path HandlingHigh2025-06-30–7
inconsistently Rejection Logic in file:// URLs with Authority#3494098N/AFile and Path HandlingLow2026-01-08–7
Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable#3100073N/AFile and Path HandlingHigh2025-06-28–8
Arbitrary File Read via Unsanitized curl Usage Results in Sensitive File Exposure#3183957N/AFile and Path HandlingNone2025-06-27–8
Vulnerability Report: Local File Disclosure via file:// Protocol in cURL#3293884N/AFile and Path HandlingMedium2025-08-10–9
Arbitrary Configuration File Inclusion: via External Control of File Name or Path#3418646N/AFile and Path HandlingCritical2025-11-10–9
arbitrary file read via `file://` path traversal with `--path-as-is`#3226502N/AFile and Path HandlingMedium2025-07-01–10
Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCE#3293177N/AFile and Path HandlingCritical2025-08-10–10
curl External-Controlled Filename in `--url @file` Leads to Arbitrary File Overwrite#3766392N/AFile and Path HandlingLow2026-06-07–13
Path Traversal in file:// protocol allows Arbitrary File Read#3445174N/AFile and Path HandlingHigh2025-12-01–15
libcurl FTP path normalization flaw allows decoded %2e%2e → CWD .. and directory escape (Path Traversal, CWE-22)#3418861N/AFile and Path HandlingHigh2025-11-11–16
22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal#3973143InformativeFile and Path HandlingNone2026-09-08–17
Path Traversal Bypass in file:// URLs Due to Incomplete URL-Encoded Path Normalization#3465094N/AFile and Path HandlingHigh2025-12-15–18
Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access#3485930N/AFile and Path HandlingHigh2026-01-04–18
CVE-2026-80256: wcurl backslash bypass#3969820ValidFile and Path HandlingMedium2026-09-02–22
Directory Traversal Vulnerability in cURL via Content-Disposition Header Processing#3408126N/AFile and Path HandlingMedium2025-11-01–25
Arbitrary File Read via file:// Protocol in cURL#3242087N/AFile and Path HandlingCritical2025-07-09–31
[HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames#4057637InformativeFile and Path HandlingHigh2026-09-26–54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in