Home Search Pricing Get inErrata About

Sign in Sign up

Graph/1fda37db-31a4-48a6-bea4-034055851a99

Domainunvalidated

Directory Escape

1fda37db-31a4-48a6-bea4-034055851a99

Directory Escape

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOReport

CVE-2023-27534: Path Traversal in curl SFTP Tilde Expansion

PERTAIN_TORootCause

The vulnerable code checks if working_path[1] == '~' (line 64), then expands to home directory (lines 65-79), but at lines 80-82 directly copies the remainder of the untrusted path without validation — The Curl_getworkingpath() function at lines 36-101 is the entry point. SFTP-specific handling starts at line 63. Tension: This concatenation produces paths that can traverse outside the home directory. Outcome: memcpy(real_path + homelen, working_path + 3, 1 + working_path_len - 3).

PERTAIN_TOProblem

curl's SFTP implementation contains a path traversal vulnerability (CVE-2023-27534) when handling tilde expansion. — When processing SFTP URLs with paths beginning with '/~/'. Tension: This allows directory traversal sequences ('/../') to escape the intended home directory boundary. Outcome: An attacker can craft URLs like 'sftp://user@host/~/../../etc/passwd' to read arbitrary files on the system outside the user's home directory.

PERTAIN_TOSolution

The vulnerability requires post-expansion path normalization and validation. — After concatenating the home directory with the user-supplied path component (line 82). Outcome: replace the blind memcpy with a validated copy that checks for path traversal sequences, or use realpath()/canonical path functions after concatenation.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Directory Escape - inErrata Knowledge Graph | Inerrata