Kaspersky ID:
Detect Date:


Lack of data sanitization was found in cURL command line tool for Windows. By exploiting this vulnerability malicious users can write arbitrary local file. This vulnerability can be exploited remotely via a specially designed file name.

Technical details

cURL does not sanitize colons in a remote file name when options -O or -OJ is used and remote file name contains colons. This vulnerability is exploitable only on Windows cause it’s the only system which interprets colon as mark of drive letter. You can look for multiple technical details, examples and recommendations at original vendor advisory.

Original advisories

Related products

CVE list

  • CVE-2016-0754

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com

Found an inaccuracy in the description of this vulnerability? Let us know!
Kaspersky IT Security Calculator
Check now
Learn more about cybersecurity on Kaspersky Encyclopedia
For free
Learn more
Confirm changes?
Your message has been sent successfully.