Arbitrary File Access
When told to follow a "redirect" automatically, libcurl does not question the new target URL but follows it to any new URL that it understands. As libcurl supports FILE:// URLs, a rogue server can thus "trick" a libcurl-using application to read a local file instead of the remote one. This is a problem, for example, when the application is running on a server and is written to upload or to otherwise provide the transferred data to a user, to another server or to another application etc, as it can be used to expose local files it was not meant to. The problem can also be exploited for uploading, if the rogue server redirects the client to a local file and thus it would (over)write a local file instead of sending it to the server. libcurl compiled to support SCP can get tricked to get a file using embedded semicolons, which can lead to execution of commands on the given server. `Location: scp://name:passwd@host/a;date >/tmp/test;`. Files on servers other than the one running libcurl are also accessible when credentials for those servers are stored in the .netrc file of the user running libcurl. This is most common for FTP servers, but can occur with any protocol supported by libcurl. Files on remote SSH servers are also accessible when the user has an unencrypted SSH key.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2009-0037
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 14:10 UTC · Revision 1
Source evidence
When told to follow a "redirect" automatically, libcurl does not question the new target URL but follows it to any new URL that it understands. As libcurl supports FILE:// URLs, a rogue server can thus "trick" a libcurl-using application to read a local file instead of the remote one. This is a problem, for example, when the application is running on a server and is written to upload or to otherwise provide the transferred data to a user, to another server or to another application etc, as it can be used to expose local files it was not meant to. The problem can also be exploited for uploading, if the rogue server redirects the client to a local file and thus it would (over)write a local file instead of sending it to the server. libcurl compiled to support SCP can get tricked to get a file using embedded semicolons, which can lead to execution of commands on the given server. `Location: scp://name:passwd@host/a;date >/tmp/test;`. Files on servers other than the one running libcurl are also accessible when credentials for those servers are stored in the .netrc file of the user running libcurl. This is most common for FTP servers, but can occur with any protocol supported by libcurl. Files on remote SSH servers are also accessible when the user has an unencrypted SSH key.
osv:CURL-CVE-2009-0037
Complete source record
{
"id": "7569caeb5e68065648ea70f0118e078b96d2ecacadbb94e890cf94dd1e620ed2",
"url": "https://osv.dev/vulnerability/CURL-CVE-2009-0037",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Arbitrary File Access",
"summary": "When told to follow a \"redirect\" automatically, libcurl does not question the new target URL but follows it to any new URL that it understands. As libcurl supports FILE:// URLs, a rogue server can thus \"trick\" a libcurl-using application to read a local file instead of the remote one. This is a problem, for example, when the application is running on a server and is written to upload or to otherwise provide the transferred data to a user, to another server or to another application etc, as it can be used to expose local files it was not meant to. The problem can also be exploited for uploading, if the rogue server redirects the client to a local file and thus it would (over)write a local file instead of sending it to the server. libcurl compiled to support SCP can get tricked to get a file using embedded semicolons, which can lead to execution of commands on the given server. `Location: scp://name:passwd@host/a;date >/tmp/test;`. Files on servers other than the one running libcurl are also accessible when credentials for those servers are stored in the .netrc file of the user running libcurl. This is most common for FTP servers, but can occur with any protocol supported by libcurl. Files on remote SSH servers are also accessible when the user has an unencrypted SSH key.",
"evidence": "osv:CURL-CVE-2009-0037",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2009-0037",
"aliases": [
"CURL-CVE-2009-0037",
"CVE-2009-0037"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "5.11"
},
{
"fixed": "7.19.4"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "ae1912cb0d494b48d514d937826c9fe83ec96c4d"
},
{
"fixed": "042cc1f69ec0878f542667cb684378869f859911"
}
]
}
],
"versions": [
"7.19.3",
"7.19.2",
"7.19.1",
"7.19.0",
"7.18.2",
"7.18.1",
"7.18.0",
"7.17.1",
"7.17.0",
"7.16.4",
"7.16.3",
"7.16.2",
"7.16.1",
"7.16.0",
"7.15.5",
"7.15.4",
"7.15.3",
"7.15.2",
"7.15.1",
"7.15.0",
"7.14.1",
"7.14.0",
"7.13.2",
"7.13.1",
"7.13.0",
"7.12.3",
"7.12.2",
"7.12.1",
"7.12.0",
"7.11.2",
"7.11.1",
"7.11.0",
"7.10.8",
"7.10.7",
"7.10.6",
"7.10.5",
"7.10.4",
"7.10.3",
"7.10.2",
"7.10.1",
"7.10",
"7.9.8",
"7.9.7",
"7.9.6",
"7.9.5",
"7.9.4",
"7.9.3",
"7.9.2",
"7.9.1",
"7.9",
"7.8.1",
"7.8",
"7.7.3",
"7.7.2",
"7.7.1",
"7.7",
"7.6.1",
"7.6",
"7.5.2",
"7.5.1",
"7.5",
"7.4.2",
"7.4.1",
"7.4",
"7.3",
"7.2.1",
"7.2",
"7.1.1",
"7.1",
"6.5.2",
"6.5.1",
"6.5",
"6.4",
"6.3.1",
"6.3",
"6.2",
"6.1",
"6.0",
"5.11",
"curl-7_19_3",
"curl-7_19_2",
"curl-7_19_1",
"curl-7_19_0",
"curl-7_18_2",
"curl-7_18_1",
"curl-7_18_0",
"curl-7_17_1",
"curl-7_17_0",
"curl-7_17_0-preldapfix",
"curl-7_16_4",
"curl-7_16_3",
"curl-7_16_2",
"curl-7_16_1",
"curl-7_16_0",
"curl-7_15_6-prepipeline",
"curl-7_15_5",
"curl-7_15_4",
"curl-7_15_3",
"curl-7_15_2",
"curl-7_15_1",
"curl-7_15_0",
"curl-7_14_1",
"curl-7_14_0",
"curl-7_13_2",
"curl-7_13_1",
"before_ftp_statemachine",
"curl-7_13_0",
"curl-7_12_3",
"curl-7_12_2",
"curl-7_12_1",
"curl-7_12_0",
"curl-7_11_2",
"curl-7_11_1",
"curl-7_11_0",
"curl-7_10_8",
"curl-7_10_7",
"curl-7_10_6",
"curl-7_10_5",
"curl-7_10_4",
"curl-7_10_3",
"curl-7_10_2",
"curl-7_10_1",
"curl-7_10",
"curl-7_9_8",
"curl-7_9_7",
"curl-7_9_7-pre2",
"curl-7_9_6",
"curl-7_9_5",
"curl-7_9_5-pre4",
"curl-7_9_5-pre2",
"curl-7_9_4",
"curl-7_9_3",
"curl-7_9_3-pre3",
"curl-7_9_3-pre2",
"curl-7_9_3-pre1",
"curl-7_9_2",
"curl-7_9_1",
"curl-7_9",
"before_urldata_rename",
"curl-7_8_1",
"curl-7_8_1-pre3",
"curl-7_8",
"curl-7_8-pre2",
"curl-7_7_3",
"curl-7_7_2",
"curl-7_7_1",
"curl-7_7",
"curl-7_7-beta5",
"curl-7_7-beta3",
"curl-7_7-beta2",
"curl-7_7-beta1",
"curl-7_7_alpha2",
"curl-7_6_1",
"curl-7_6_1-pre3",
"curl-7_6_1-pre2",
"curl-7_6_1-pre1",
"curl-7_6",
"curl-7_6-pre4",
"curl_7_6-pre3",
"curl-7_5_2",
"curl-7_5",
"curl-7_4_1",
"curl-7_3",
"curl-7_2",
"curl-7_1_1",
"curl-6_5_2",
"curl-6_5_1",
"curl-6_5"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2009-0037.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2009-0037-159f29bc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310830666648635066956287083945093218137",
"14460778665075801970030897651985159821",
"67289876690961980609857547235819304273",
"108253723266719992308559813373159066391",
"114157038688027889160455695506276308083",
"3680853883501677942441893072465002665",
"268184971089781477791360401908957570476",
"23357178132640841728405853861983698094",
"93569203271119595950142741331671454889"
]
},
"source": "https://github.com/curl/curl.git/commit/042cc1f69ec0878f542667cb684378869f859911",
"target": {
"file": "lib/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2009-0037-23a2d981",
"digest": {
"threshold": 0.9,
"line_hashes": [
"155117434170459043260086414455916434921",
"119244673102177051827712747562267400801",
"126521293628496759759657566623628090089",
"36273232399208601908612346185396834973",
"83872637572426875013819294839968609431",
"120117297025705112923098309012718761973",
"173863287716765609326775489092599630781"
]
},
"source": "https://github.com/curl/curl.git/commit/042cc1f69ec0878f542667cb684378869f859911",
"target": {
"file": "lib/urldata.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2009-0037-31cdbc79",
"digest": {
"threshold": 0.9,
"line_hashes": [
"296330161650831415412564280083640208008",
"314128023345881561720719054747711707106",
"216323952747770605609050728020542276615",
"333079962586958784331342967425326871910",
"234338421012705842572420254088074172447",
"87228205603607148876597539119266995952"
]
},
"source": "https://github.com/curl/curl.git/commit/042cc1f69ec0878f542667cb684378869f859911",
"target": {
"file": "include/curl/curl.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2009-0037-a3c5625f",
"digest": {
"length": 24266,
"function_hash": "257905614394854800781978839845878404615"
},
"source": "https://github.com/curl/curl.git/commit/042cc1f69ec0878f542667cb684378869f859911",
"target": {
"file": "lib/url.c",
"function": "Curl_setopt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2009-0037-e60f848b",
"digest": {
"length": 1602,
"function_hash": "301075944759968825652771901389386298700"
},
"source": "https://github.com/curl/curl.git/commit/042cc1f69ec0878f542667cb684378869f859911",
"target": {
"file": "lib/url.c",
"function": "Curl_init_userdefined"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2009-0037-ff978ce6",
"digest": {
"length": 721,
"function_hash": "118857053075254119951035780996427473957"
},
"source": "https://github.com/curl/curl.git/commit/042cc1f69ec0878f542667cb684378869f859911",
"target": {
"file": "lib/url.c",
"function": "setup_connection_internals"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-26T13:07:51Z"
}
}
],
"modified": "2026-10-26T13:07:51.096329834Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-142",
"desc": "Improper Neutralization of Value Delimiters"
},
"URL": "https://curl.se/docs/CVE-2009-0037.json",
"www": "https://curl.se/docs/CVE-2009-0037.html",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.19.3"
}
},
"related_cves": [
{
"value": "CVE-2009-0037",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 453272,
"published_at": "2009-03-03T08:00:00+00:00"
}