CVE-2022-27778 Other in https://github.com/curl/curl

High 8.1 Published 1 Jun 2022 Updated 14 Oct 2026

Attackers can cause unintended file deletion when using specific curl options, potentially leading to data loss.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-27778?

CVE-2022-27778 is a high-severity vulnerability in Haxx Curl, published on 1 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.

Weakness: CWE-706

Which versions are affected by CVE-2022-27778?

It affects 14 products.

Products include Haxx Curl, Netapp Active Iq Unified Manager, Netapp Bh500s Firmware, Netapp Clustered Data Ontap, Netapp H300s Firmware, Netapp H410s Firmware and 8 more.

How do I fix CVE-2022-27778?

Upgrade to a fixed version.

Is CVE-2022-27778 being exploited?

There is no known exploitation of CVE-2022-27778 in the wild and no public exploit code.

All Haxx Curl vulnerabilities

Sources

Also known as ALPINE-CVE-2022-27778, AZL-9876, CLEANSTART-2026-WP36536, CURL-CVE-2022-27778, DEBIAN-CVE-2022-27778, GHSA-rh8g-j53h-g8xf.