CVE-2020-8177: Debian Linux

High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days.

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Affected products

• Debian Debian Linux: version 10.0 only
• Fujitsu m10-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
• Fujitsu m10-4 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
• Fujitsu m10-4s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
• Fujitsu m12-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
• Fujitsu m12-2 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
• Fujitsu m12-2s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
• Haxx Curl: from 7.20.0, up to and including 7.70.0
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2020-12-14. Last modified 2026-06-17.