Vulnerability
curl/libcurl: local file overwrite
curl offers a command line option --remote-header-name (also usable as -J) which uses the filename of the Content-disposition: header when it saves the downloaded data locally. curl attempts to cut off the directory parts from any given filename in the header to only store files in the current directory. It might overwrite a local file using the same name as the header specifies. The stripping of the directory did not take backslashes into account. On some operating systems, backslashes are used to separate directories and filenames. This allows a rogue server to send back a response that overwrites a filename in the local machine that the user is allowed to write, potentially a system file, a command or a known executable. Operating systems affected include Windows, Netware, MSDOS, OS/2 and Symbian. This error is only present in the curl command line tool, it is NOT a problem of the library libcurl.
No CVSS 3.x base score yet. Since April 2026 NVD only enriches priority CVEs (KEV, federal and critical software), so most CVEs are scored only if the assigning CNA included a score in the CVE record, or by GHSA for open-source packages. Last record update .
For interim severity, fall back on KEV / EXPLOIT signals and the EPSS percentile (lower panel). Re-check this CVE after one cron tick — the score lands automatically when the source publishes.
Mid-pack — moderate exploitation likelihood.
No VEX statements published for CVE-2010-3842. Vendors publish VEX (Vulnerability Exploitability eXchange) to assert per-product whether a CVE is actually exploitable in their distribution.
No exploitation, limited impact or prevalence