Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessApp enables FTP wildcard matching
-
DeliveryConnect to attacker-influenced FTP server
-
ExploitTrigger multi-file wildcard transfer
-
ExecutionWrite callback mapped to wrong transfer
-
ImpactData corruption or cross-file leak
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the consuming application to explicitly enable libcurl's FTP wildcard matching feature (CURLOPT_WILDCARDMATCH with a globbed FTP URL) - this is NOT a default configuration and is used by a small minority of libcurl integrations. It further requires the client to transfer multiple matching files from an FTP server whose responses the attacker can influence or control. These two conditions together - a non-default feature flag plus an attacker-positioned FTP server - are strong limiting factors; a default curl/libcurl deployment that does not use FTP wildcards is not exposed. The feature applies only to the FTP protocol, further narrowing the affected population. |
| Impact | No CVSS vector, EPSS score, KEV listing, or POC is present in the provided data, so quantitative exploitation signals are entirely absent and must be stated as unknown rather than inferred. The authoritative source (the curl project's own advisory) rates this vulnerability as severity LOW, the lowest of the 24 issues released with curl 8.23.0 (the single HIGH issue in that batch is the unrelated CVE-2026-92392 HTTP/2 Use-After-Free). This is a libcurl ('lib' category) defect in the FTP wildcard matching feature where the write callback is mixed up; it is not remote-unauthenticated code execution and does not appear on CISA KEV. The practical risk is low-to-marginal: exploitation depends on an application deliberately enabling libcurl's non-default FTP wildcard matching feature AND connecting to an attacker-influenced FTP server, which is a narrow and uncommon combination. Treat this as a hygiene/maintenance patch rather than an emergency: the vendor's own LOW rating is consistent with the absence of any exploitation-probability data, and nothing in the input elevates it. Missing data: no CVSS, no EPSS, no CWE, and no per-CVE technical detail beyond the one-line title - the specific impact (information leak vs. data corruption) is not confirmed and should be verified against the per-CVE page on curl.se/docs/security.html. |
| Exploit ScenarioDerived | An application uses libcurl with FTP wildcard matching enabled to download multiple files matching a glob pattern from an FTP server an attacker controls or can influence. Due to the write callback mixup, data from one transfer is delivered to the wrong callback context, potentially corrupting output or leaking content between files. No public exploit code is identified at time of analysis, and the attack requires the application to opt into the rarely-used wildcard feature. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
FTP wildcard downloads in libcurl 7.21.0 through 8.22.0 can misroute transferred file data to the wrong application-supplied write callback, giving limited confidentiality and integrity impact (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) to unauthenticated remote attackers. The flaw is only reachable when a consuming application explicitly enables CURLOPT_WILDCARDMATCH with a glob-expanded FTP URL - a non-default option used by a small minority of integrations - and when the client fetches multiple matching files from an FTP server whose responses the attacker can influence or control; a default curl/libcurl build that does not use FTP wildcards is not exposed. The curl project rates this as LOW severity, the fix ships in curl/libcurl 8.23.0, and no public exploit has been identified at time of analysis; no EPSS score, KEV listing, or public proof-of-concept is present in the available data.
RemediationAI
Upgrade to curl/libcurl 8.23.0, the vendor-released patch release that contains the fix commit for CVE-2026-92388 (advisory: https://curl.se/docs/security.html; batch announcement: https://seclists.org/oss-sec/2026/q4/154); if you consume libcurl through an OS distribution or vendored dependency, request or backport the upstream fix rather than waiting on a version bump. Where upgrading is not immediately possible, the exposure is eliminated by not enabling CURLOPT_WILDCARDMATCH and not issuing glob-expanded FTP URLs - the trade-off being that multi-file FTP retrieval via wildcards stops working and applications must enumerate and fetch files explicitly instead. Because the flaw is reachable only over FTP, restricting or blocking outbound FTP (port 21 and any negotiated data channels) from clients that do not need it neutralises exposure at the network layer, at the cost of breaking legitimate FTP workflows. Note that a single malicious or compromised FTP server is a prerequisite, so trusting only controlled FTP endpoints reduces but does not eliminate risk; the curl project additionally offers the Rock-solid curl LTS programme (https://rock-solid.curl.dev), which applies security and selected stability patches to maintained branches for support customers. No vendor-released patch other than 8.23.0 is identified for older 7.x/8.x lines in the available data.
Affected ProductsAI
The vulnerability affects curl and libcurl versions 7.21.0 through 8.22.0 inclusive, specifically any application that links libcurl and uses the FTP wildcard matching feature (CURLOPT_WILDCARDMATCH with a globbed FTP URL); no CPE strings were supplied in the source data. It was published on 2026-10-14 alongside the curl 8.23.0 release, which is the first fixed version, and the entry is tagged 'lib' (library code, not the curl command-line tool) in curl's vulnerability table. Only the FTP protocol path is reachable, so HTTP(S), SFTP, SCP, TFTP, WebSocket, and IMAP users of the same release range are unaffected by this specific CVE. Details, version table, and the linked fix commit are published at the curl security page (https://curl.se/docs/security.html), with the batch announcement archived on oss-security (https://seclists.org/oss-sec/2026/q4/154) and LTS backport options described at https://rock-solid.curl.dev.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libcurl's FTP wildcard feature (CURLOPT_WILDCARDMATCH, introduced in 7.21.0) lets an application pass a globbed FTP URL and have libcurl enumerate remote directory entries and download every matching file, invoking the application's write callback for each transfer. Supporting this involves a set of chunk/entry callbacks (CURLOPT_CHUNK_BGN_FUNCTION, CURLOPT_CHUNK_END_FUNCTION) plus the standard CURLOPT_WRITEFUNCTION, and libcurl maintains internal per-transfer state that tracks which glob-matched file is currently being written. CVE-2026-92388 is a state mixup in that bookkeeping: when several matching files are transferred in sequence against an FTP server whose responses can be manipulated, data can be handed to a write callback bound to a different transfer than the one currently active, producing unintended cross-file write/misattribution behaviour. No CWE identifier was supplied with the CVE data, but the root-cause class is improper state handling / incorrect callback selection across iterated transfers rather than a memory-safety defect (unlike the HIGH-severity CVE-2026-92392 HTTP/2 upload use-after-free shipped in the same 8.23.0 batch). The bug is confined to the FTP protocol handler in the library ('lib' in curl's vulnerability table) and spans every release from the feature's 7.21.0 introduction through 8.22.0; curl 8.23.0 contains the fix commit and advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Reaching the FTP server is network-based but requires a non-default wildcard config plus attacker-influenced server, so AC:H; callback mixup yields limited leak/corruption, so C:L/I:L and A:N.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB