CVE-2022-27778
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when...
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
CVE-2022-27778- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-706
- Updated
- 2026-11-02
CVE List No score
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
CVE-2022-27778- Weakness
- CWE-706
- Updated
- 2026-11-02
EUVDEUVD-2022-32273 No score
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
EUVD-2022-32273- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rh8g-j53h-g8xf
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when...
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
GHSA-rh8g-j53h-g8xf- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Weakness
- CWE-706
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-27778
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
ALPINE-CVE-2022-27778- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-03
OSVAZL-9876
CVE-2022-27778 affecting package curl for versions less than 7.83.1-1
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
AZL-9876- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVBELL-CVE-2022-27778
CVE-2022-27778 does not affect BellSoft software
- Record
BELL-CVE-2022-27778- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-27778
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
DEBIAN-CVE-2022-27778- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-03
OSVCURL-CVE-2022-27778 No score
curl removes wrong file on error
curl might remove the wrong file when --no-clobber is used together with
--remove-on-error.
The --remove-on-error option tells curl to remove the output file when it
returns an error, and not leave a partial file behind. The --no-clobber
option prevents curl from overwriting a file if it already exists, and instead
appends a number to the name to create a new unused filename.
If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the original filename without the added number.
- Record
CURL-CVE-2022-27778- Updated
- 2026-11-02
OSV No score
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when --no-clobber is used together with --remove-on-error.
- Record
CVE-2022-27778- Weakness
- CWE-706
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12062-1 No score
curl-7.83.1-1.1 on GA media
These are all security issues fixed in the curl-7.83.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12062-1- Updated
- 2026-11-02
Affected products
- haxx curl
- netapp active iq unified manager
- netapp bh500s firmware
- netapp clustered data ontap
- netapp h300s firmware
- netapp h410s firmware
- netapp h700s firmware
- netapp hci compute node firmware
- netapp oncommand insight
- netapp oncommand workflow automation
- netapp snapcenter
- netapp solidfire \& hci management node
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.16 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.17 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.18 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.19 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.20 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.21 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.22 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.23 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.24 |
before 7.83.1-r0 | 7.83.1-r0 |
curlAzure Linux:2 |
before 7.83.1-1 | 7.83.1-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-27778 is a high vulnerability (CVSS 8.1) in Haxx Curl, published May 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.81%, the 90th percentile. Fixed in curl 7.83.1-r0.
References
hackerone.com/reports/1553598
oracle.com/security-alerts/cpujul2022.html
security.netapp.com/advisory/ntap-20220609-0009
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2022-27778
Show 11 moreShow less
github.com/advisories/GHSA-rh8g-j53h-g8xf
security.alpinelinux.org/vuln/CVE-2022-27778
docs.bell-sw.com/security/cves/CVE-2022-27778
security-tracker.debian.org/tracker/CVE-2022-27778
suse.com/security/cve/CVE-2022-27778