CVE-2023-27534 @ Archive
Status
new
Priority
3.82
Match score
4.0
Risk
RCE
InfoLeak
Remote
priv:user
CVSS
8.8 HIGH
Reason
cpe: curl; pkgs: curl; version: in-range: curl-7.64.0-4+deb10u9; risk:rce; remote
Created
2026-10-15T10:20:14Z
Updated
2026-10-20T10:18:27Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| curl-7.64.0-4+deb10u9 | |
| libcurl4-7.64.0-4+deb10u9 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: curl
| System | Matches | Ticket for CVE-2023-27534 | |
|---|---|---|---|
| Archive | curl 7.64.0-4+deb10u9; libcurl4 7.64.0-4+deb10u9 | new open | |
| Janus | curl 7.64.0-4+deb10u9; libcurl3-gnutls 7.64.0-4+deb10u9; libcurl4 7.64.0-4+deb10u9 | new open | |
| Library | curl 7.52.1-5+deb9u16; libcurl3 7.52.1-5+deb9u16; libcurl3-gnutls 7.52.1-5+deb9u16; php7.0-curl 7.0.33-0+deb9u12 | new open | |
| Saiph | curl 7.64.0-4+deb10u9; libcurl3-gnutls 7.64.0-4+deb10u9; libcurl4 7.64.0-4+deb10u9 | new open | |
| morris | alt-curl 7.64.0; alt-curlssl 7.62.0; alt-curlssl11 8.22.0; alt-libcurl 7.64.0; alt-libcurlssl 7.62.0; alt-libcurlssl11 8.22.0; cpanel-perl-536-net-curl 0.50; cpanel-perl-536-net-curl-promiser 0.18 (+13 more) | new open | |
| mufasa | alt-curl 7.64.0; alt-curlssl11 8.22.0; alt-libcurl 7.64.0; alt-libcurlssl 7.62.0; alt-libcurlssl11 8.22.0; cpanel-perl-536-net-curl 0.50; cpanel-perl-536-net-curl-promiser 0.18; curl 7.29.0 (+5 more) | new open | |
| Bullseye | libcurl3-gnutls 7.74.0-1.3+deb11u16; libcurl4 7.74.0-1.3+deb11u16; python3-pycurl 7.43.0.6-5 | none | |
| Helios | curl 7.74.0-1.3+deb11u16; libcurl3-gnutls 7.74.0-1.3+deb11u16; libcurl4 7.74.0-1.3+deb11u16 | none | |
| Matrix | curl 7.88.1-10+deb12u15; libcurl3-gnutls 7.88.1-10+deb12u15; libcurl4 7.88.1-10+deb12u15; python3-pycurl 7.45.2-3 | none | |
| Silk | alt-curlssl 8.22.0-2; alt-libcurlssl 8.22.0-2; curl 7.88.1-10+deb12u15; libcurl3-gnutls 7.88.1-10+deb12u15; libcurl4 7.88.1-10+deb12u15; php8.2-curl 8.2.34-1~deb12u1; python3-pycurl 7.45.2-3 | none |
Same product CVEs in your queue
Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2022-32221 | 9.8 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2023-27533 | 8.8 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2024-2398 | 8.6 | Archive, Janus, Library, Saiph | new | curl | — | ||
| CVE-2021-22946 | 7.5 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2022-27782 | 7.5 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2022-27781 | 7.5 | Archive, Janus, Library, Saiph, morris … | new | curl | — | ||
| CVE-2021-22926 | 7.5 | Archive, Helios, Janus, Library, Saiph | new | curl | — | ||
| CVE-2025-0725 | 7.3 | Archive, Helios, Janus, Library, Matrix … | new | curl | — |
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Host OS / kernel
OS
Debian GNU/Linux 10 (buster)
(10)
· debian
Arch
x86_64
kernel_release
uname -r → 5.10.0-25-amd64kernel_version
uname -v → #1 SMP Debian 5.10.191-1 (2023-08-16)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | new | 11.3 | 2026-10-20T10:18:27Z | Open |
| mufasa | new | 11.3 | 2026-10-20T10:18:27Z | Open |
| Library | new | 5.14 | 2026-10-20T10:18:27Z | Open |
| Janus | new | 3.82 | 2026-10-20T10:18:27Z | Open |
| Saiph | new | 3.82 | 2026-10-20T10:18:27Z | Open |
Description
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.
Update status
Add note only
References
- https://hackerone.com/reports/1892351
- https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20230420-0012/
- https://hackerone.com/reports/1892351
- https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20230420-0012/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-806742.html
- https://cert-portal.siemens.com/productcert/html/ssa-943925.html
NVD: CVE-2023-27534