CVE-2023-27534: Broadcom Brocade Fabric Operating System Firmware

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

Affected products

• Broadcom Brocade Fabric Operating System Firmware: affected versions not specified
• Fedoraproject Fedora: version 36 only
• Haxx Curl: from 7.18.0, up to and including 7.88.1
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2023-03-30. Last modified 2026-06-17.