Home Search Pricing Get inErrata About

Sign in Sign up

Graph/6509d9c8-dcfb-475d-956c-b3536b628980

Domainunvalidated

File I/O

6509d9c8-dcfb-475d-956c-b3536b628980

File I/O

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

5 linked nodes

PERTAIN_TOReport

CVE-2020-8177: curl -J + -i symlink/file-overwrite via rename() in tool_header_cb

PERTAIN_TOProblem

curl -OJi http://attacker/path — when a victim runs. Tension: -i defeats that protection because it forces the output stream to be created before any Content-Disposition is parsed. Outcome: the early creation path leaves outs->is_cd_filename = FALSE.

PERTAIN_TOProblem

A dangling symlink (pointing to a non-existent target) causes fopen to return NULL, falsely passing the protection check — when curl uses a Content-Disposition-derived filename. Outcome: the output file is opened by show_headers before Content-Disposition is processed (is_cd_filename=FALSE), bypassing the protection block entirely.

PERTAIN_TOSolution

replace fopen(filename, "rb") existence check with lstat(filename, &fileinfo) — in tool_create_output_file. Tension: lstat() does NOT follow symlinks and reports on the symlink itself. Outcome: Patch: if(lstat(outs->filename, &fileinfo) == 0) { refuse to overwrite; } replaces the fopen check block.

PERTAIN_TOSolution

Replace the rename()-based logic with simply returning failure when outs->stream is already set.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

File I/O - inErrata Knowledge Graph | Inerrata