{"id":"CVE-2010-3842","aliases":["CURL-CVE-2010-3842","EUVD-2010-3821","GHSA-fwfv-5xmw-xx69"],"status":"published","title":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header...","description":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01715,"percentile":0.77576,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2010-10-13T08:00:00Z","modified":"2026-10-26T13:07:53Z","products":[{"vendor":"curl","product":"curl"}],"references":[{"url":"http://curl.haxx.se/docs/adv_20101013.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2010/10/13/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2010/10/13/5","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://securitytracker.com/id?1024583","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://secunia.com/advisories/39532","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2010/10/13/1","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=642642","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3842"},{"url":"https://github.com/advisories/GHSA-fwfv-5xmw-xx69"}],"sources":{"cve":[{"id":"CVE-2010-3842","description":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.","status":"published","published":"2010-10-27T22:00:00Z","modified":"2024-08-07T03:26:12.269Z","updated_at":"2026-11-02T14:33:27.739358Z"}],"euvd":[{"id":"EUVD-2010-3821","description":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.","status":"published","published":"2010-10-27T22:00:00Z","modified":"2024-08-07T03:26:12Z","updated_at":"2026-11-03T01:39:32.539513Z"}],"ghsa":[{"id":"GHSA-fwfv-5xmw-xx69","title":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header...","description":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.","status":"published","published":"2022-05-17T05:47:12Z","modified":"2023-01-28T05:04:35Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:44:12.284845Z"}],"nvd":[{"id":"CVE-2010-3842","description":"Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote servers to create or overwrite arbitrary files by using \\ (backslash) as a separator of path components within the Content-disposition HTTP header.","status":"published","published":"2010-10-28T00:00:05.453Z","modified":"2026-06-16T23:23:39.37Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:01:57.065463Z"}],"osv":[{"id":"CURL-CVE-2010-3842","title":"local file overwrite","description":"curl offers a command line option --remote-header-name (also usable as -J)\nwhich uses the filename of the Content-disposition: header when it saves the\ndownloaded data locally.\n\ncurl attempts to cut off the directory parts from any given filename in the\nheader to only store files in the current directory. It might overwrite a\nlocal file using the same name as the header specifies.\n\nThe stripping of the directory did not take backslashes into account. On\nsome operating systems, backslashes are used to separate directories and\nfilenames. This allows a rogue server to send back a response that\noverwrites a filename in the local machine that the user is allowed to\nwrite, potentially a system file, a command or a known executable.\n\nOperating systems affected include Windows, Netware, MSDOS, OS/2 and\nSymbian.\n\nThis error is only present in the curl command line tool, it is NOT a\nproblem of the library libcurl.","status":"published","published":"2010-10-13T08:00:00Z","modified":"2026-10-26T13:07:53.35391949Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}