Uncontrolled File Write/Arbitrary File Creation

[smartberry9]

https://hackerone.com/reports/3250117

[dcrazy]

I hope you’re not also the one who submitted this “vulnerability”. If you are, prepare to have your mind blown by `sudo rm /etc/passwd`.

[porridgeraisin]

Won't be surprised if this gets a CVE

[dcrazy → porridgeraisin]

You “wouldn’t be surprised” if curl issues a CVE for the existence of the -o flag?

[porridgeraisin → dcrazy]

It was sarcastic. Because of the ...low signal-noise ratio... in CVEs these days.

[dcrazy → porridgeraisin]

curl has become their own CNA specifically because so many useless CVEs about curl were being issued by other parties: https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/