CVE-2019-15601
curl: improper input validation allows users to create a 'FILE:' URL that can make the client access a remote file using SMB
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 6, 2020
Updated · August 10, 2026
Description
[REJECTED CVE] A vulnerability has been identified in libcurl, where a FILE:// URL crafted with two slashes (or backslashes) followed by a hostname can cause Windows systems to treat the path as an SMB request instead of accessing a local file. This unintended behavior may allow an attacker to redirect file access requests to a malicious SMB server. Applications that allow user-provided URLs or URL parts are particularly vulnerable, potentially exposing sensitive data or enabling unauthorized network interactions.
Statement
This bug only exists when libcurl runs on a Microsoft Windows operating system.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-20 · Improper Input Validation