{"id":"CURL-CVE-2020-8177","summary":"curl overwrite local file with -J","details":"curl can be tricked by a malicious server to overwrite a local file when using\n`-J` (`--remote-header-name`) and `-i` (`--include`) in the same command line.\n\nThe command line tool offers the `-J` option that saves a remote file using\nthe filename present in the `Content-Disposition:` response header. curl then\nrefuses to overwrite an existing local file using the same name, if one\nalready exists in the current directory.\n\nThe `-J` flag is designed to save a response body, and so it does not work\ntogether with `-i` and there is logic that forbids it. However, the check is\nflawed and does not properly check for when the options are used in the\nreversed order: first using `-J` and then `-i` were mistakenly accepted.\n\nThe result of this mistake was that incoming HTTP headers could overwrite a\nlocal file if one existed, as the check to avoid the local file was done first\nwhen body data was received, and due to the mistake mentioned above, it could\nalready have received and saved headers by that time.\n\nThe saved file would only get response headers added to it, as it would abort\nthe saving when the first body byte arrives. A malicious server could however\nstill be made to send back virtually anything as headers and curl would save\nthem like this, until the first CRLF-CRLF sequence appears.\n\n(Also note that `-J` needs to be used in combination with `-O` to have any\neffect.)","aliases":["CVE-2020-8177"],"modified":"2026-04-25T20:38:42.578468Z","published":"2020-06-24T08:00:00Z","database_specific":{"severity":"Medium","www":"https://curl.se/docs/CVE-2020-8177.html","issue":"https://hackerone.com/reports/887462","affects":"tool","last_affected":"7.70.0","URL":"https://curl.se/docs/CVE-2020-8177.json","package":"curl","CWE":{"desc":"Improper Restriction of Names for Files and Other Resources","id":"CWE-641"},"award":{"currency":"USD","amount":"700"}},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"80675818e0417be8c991513b328c5507e93b47e5"},{"fixed":"8236aba58542c5f89f1d41ca09d84579efb05e22"}]}],"versions":["7.70.0","7.69.1","7.69.0","7.68.0","7.67.0","7.66.0","7.65.3","7.65.2","7.65.1","7.65.0","7.64.1","7.64.0","7.63.0","7.62.0","7.61.1","7.61.0","7.60.0","7.59.0","7.58.0","7.57.0","7.56.1","7.56.0","7.55.1","7.55.0","7.54.1","7.54.0","7.53.1","7.53.0","7.52.1","7.52.0","7.51.0","7.50.3","7.50.2","7.50.1","7.50.0","7.49.1","7.49.0","7.48.0","7.47.1","7.47.0","7.46.0","7.45.0","7.44.0","7.43.0","7.42.1","7.42.0","7.41.0","7.40.0","7.39.0","7.38.0","7.37.1","7.37.0","7.36.0","7.35.0","7.34.0","7.33.0","7.32.0","7.31.0","7.30.0","7.29.0","7.28.1","7.28.0","7.27.0","7.26.0","7.25.0","7.24.0","7.23.1","7.23.0","7.22.0","7.21.7","7.21.6","7.21.5","7.21.4","7.21.3","7.21.2","7.21.1","7.21.0","7.20.1","7.20.0"],"database_specific":{"vanir_signatures_modified":"2026-04-25T20:38:42Z","vanir_signatures":[{"signature_type":"Function","deprecated":false,"digest":{"length":3335,"function_hash":"199970256385423915349304268191894397674"},"target":{"function":"tool_header_cb","file":"src/tool_cb_hdr.c"},"source":"https://github.com/curl/curl.git/commit/8236aba58542c5f89f1d41ca09d84579efb05e22","id":"CURL-CVE-2020-8177-677f1fb1","signature_version":"v1"},{"signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["116061019339859011694030532516786133574","155641202549686486523332306578826527363","54753136006731828942239281717552956336","296887675917058167822353194754572525158"]},"target":{"file":"src/tool_getparam.c"},"source":"https://github.com/curl/curl.git/commit/8236aba58542c5f89f1d41ca09d84579efb05e22","id":"CURL-CVE-2020-8177-78e9e990","signature_version":"v1"},{"signature_type":"Function","deprecated":false,"digest":{"length":31783,"function_hash":"87642312644709809976072261365791905246"},"target":{"function":"getparameter","file":"src/tool_getparam.c"},"source":"https://github.com/curl/curl.git/commit/8236aba58542c5f89f1d41ca09d84579efb05e22","id":"CURL-CVE-2020-8177-8f29f923","signature_version":"v1"},{"signature_type":"Line","deprecated":false,"digest":{"threshold":0.9,"line_hashes":["286895013182950075166036848406221992096","258569945566588772279943309574002335383","144869481224603182242709422539955781289","171457237244487460579103396132147242887","181764972928126467942388788163277184098","302582013856799800588882298155846086554","253342496056378788837245308668091297961","16002101938793129165035374609937209526","99101775968245942737359604662129034056","192747156636641410260783562613088801957","328067430002779520667223709354835284959","237811893285258051715718461651790731472","200681367666233024858196283918491781531","195936311419697770975512179058665319611","256181439150538530857768469767924111447","310470984239033218120322628448619903429","102392186469260102880336934299407503716","168512603647264694324216763505547948095","276853035220816728622143078021047923484"]},"target":{"file":"src/tool_cb_hdr.c"},"source":"https://github.com/curl/curl.git/commit/8236aba58542c5f89f1d41ca09d84579efb05e22","id":"CURL-CVE-2020-8177-c3f5b5af","signature_version":"v1"}],"source":"https://curl.se/docs/CURL-CVE-2020-8177.json"}}],"schema_version":"1.7.5","credits":[{"name":"sn on hackerone","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}