Detections
Analytics

Echo: curl-7.69.1: security update to 7.69.1+e1

high Tenable Self-Hosted Container Security Plugin ID 476235

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to
 be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as
 the first element to indicate a path relative to the user's home directory. Attackers can exploit this
 flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a
 server with a specific user. (CVE-2023-27534)

Solution

Update the curl-7.69.1 library and its related packages to version 7.69.1+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2023-27534

Plugin Details

Severity: High

ID: 476235

Version: Revision 1.1

Type: Local

Published: 10/20/2026

Updated: 10/20/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-27534

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 3/20/2023

Reference Information

CVE: CVE-2023-27534