{"id":"CVE-2022-27778","aliases":["ALPINE-CVE-2022-27778","AZL-9876","BELL-CVE-2022-27778","CURL-CVE-2022-27778","DEBIAN-CVE-2022-27778","EUVD-2022-32273","GHSA-rh8g-j53h-g8xf","openSUSE-SU-2024:12062-1"],"status":"published","title":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when...","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03808,"percentile":0.90118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-706"],"published":"2022-05-11T08:00:00Z","modified":"2026-11-03T08:02:19Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.83.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.83.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.83.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"haxx","product":"curl"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"bh500s_firmware"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_compute_node_firmware"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"oracle","product":"mysql_server"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/1553598","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0009/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27778","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0009"},{"url":"https://security.netapp.com/advisory/ntap-20220729-0004"},{"url":"https://github.com/advisories/GHSA-rh8g-j53h-g8xf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-27778","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-27778","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27778.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-27778","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-27782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30115","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-27778","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-01T19:03:32Z","modified":"2026-10-14T16:20:07.206Z","cwes":["CWE-706"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-32273","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-01T19:03:32Z","modified":"2026-10-14T16:20:07Z","updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-rh8g-j53h-g8xf","title":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when...","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-03T00:01:03Z","modified":"2026-10-14T18:32:30Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T15:13:27.339015Z"}],"nvd":[{"id":"CVE-2022-27778","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-02T14:15:43.903Z","modified":"2026-10-14T17:17:36.913Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"ALPINE-CVE-2022-27778","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-02T14:15:43.903Z","modified":"2026-11-03T07:18:33.144982663Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-9876","title":"CVE-2022-27778 affecting package curl for versions less than 7.83.1-1","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-02T14:15:43Z","modified":"2026-04-21T04:35:09.79975Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2022-27778","title":"CVE-2022-27778 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:29.419205Z","modified":"2026-01-26T09:48:18.463309Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-27778","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-02T14:15:43.903Z","modified":"2026-11-03T08:02:19.337380988Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"CURL-CVE-2022-27778","title":"curl removes wrong file on error","description":"curl might remove the wrong file when `--no-clobber` is used together with\n`--remove-on-error`.\n\nThe `--remove-on-error` option tells curl to remove the output file when it\nreturns an error, and not leave a partial file behind. The `--no-clobber`\noption prevents curl from overwriting a file if it already exists, and instead\nappends a number to the name to create a new unused filename.\n\nIf curl adds a number to not \"clobber\" the output and an error occurs during\ntransfer, the remove on error logic would remove the *original* filename\nwithout the added number.","status":"published","published":"2022-05-11T08:00:00Z","modified":"2026-10-25T01:04:48.892231613Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"CVE-2022-27778","description":"A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.","status":"published","published":"2022-06-01T19:03:32Z","modified":"2026-10-28T02:31:11.854167341Z","cwes":["CWE-706"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"openSUSE-SU-2024:12062-1","title":"curl-7.83.1-1.1 on GA media","description":"These are all security issues fixed in the curl-7.83.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:09:50.406328Z","updated_at":"2026-11-02T16:58:35.485255Z"}]}}