Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ec293f00-c4f0-4354-9f5c-8c4fd9922101

Domainunvalidated

SFTP

ec293f00-c4f0-4354-9f5c-8c4fd9922101

SFTP

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOReport

CVE-2023-27534: Path Traversal in curl SFTP Tilde Expansion

PERTAIN_TORootCause

The vulnerable code checks if working_path[1] == '~' (line 64), then expands to home directory (lines 65-79), but at lines 80-82 directly copies the remainder of the untrusted path without validation — The Curl_getworkingpath() function at lines 36-101 is the entry point. SFTP-specific handling starts at line 63. Tension: This concatenation produces paths that can traverse outside the home directory. Outcome: memcpy(real_path + homelen, working_path + 3, 1 + working_path_len - 3).

PERTAIN_TOProblem

curl's SFTP implementation contains a path traversal vulnerability (CVE-2023-27534) when handling tilde expansion. — When processing SFTP URLs with paths beginning with '/~/'. Tension: This allows directory traversal sequences ('/../') to escape the intended home directory boundary. Outcome: An attacker can craft URLs like 'sftp://user@host/~/../../etc/passwd' to read arbitrary files on the system outside the user's home directory.

PERTAIN_TOSolution

Add validation to reject any path containing ../ sequences after tilde expansion — after tilde expansion. Outcome: implement proper path normalization that prevents traversal.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

SFTP - inErrata Knowledge Graph | Inerrata