CVE-2010-3842
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header...
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
Exploit likelihood
What each source reports
NVD Score used
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
- Record
CVE-2010-3842- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
- Record
CVE-2010-3842- Updated
- 2026-11-02
EUVDEUVD-2010-3821 No score
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
- Record
EUVD-2010-3821- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fwfv-5xmw-xx69 No score
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header...
Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \ (backslash) as a separator of path components within the Content-disposition HTTP header.
- Record
GHSA-fwfv-5xmw-xx69- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVCURL-CVE-2010-3842 No score
local file overwrite
curl offers a command line option --remote-header-name (also usable as -J) which uses the filename of the Content-disposition: header when it saves the downloaded data locally.
curl attempts to cut off the directory parts from any given filename in the header to only store files in the current directory. It might overwrite a local file using the same name as the header specifies.
The stripping of the directory did not take backslashes into account. On some operating systems, backslashes are used to separate directories and filenames. This allows a rogue server to send back a response that overwrites a filename in the local machine that the user is allowed to write, potentially a system file, a command or a known executable.
Operating systems affected include Windows, Netware, MSDOS, OS/2 and Symbian.
This error is only present in the curl command line tool, it is NOT a problem of the library libcurl.
- Record
CURL-CVE-2010-3842- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3842 is a medium vulnerability (CVSS 5.8) in Curl, published October 13, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. No source names a fixed version.
References
curl.haxx.se/docs/adv_20101013.html
openwall.com/lists/oss-security/2010/10/13/4
securitytracker.com/id?1024583
secunia.com/advisories/39532
bugzilla.redhat.com/show_bug.cgi?id=642642
nvd.nist.gov/vuln/detail/CVE-2010-3842
github.com/advisories/GHSA-fwfv-5xmw-xx69