CVE-2023-27534: 
MySQL vulnerability analysis and mitigation

CVE-2023-27534 is a path traversal vulnerability discovered in curl versions prior to 8.0.0. The vulnerability affects the SFTP implementation where the tilde (~) character is incorrectly handled when used as a prefix in the first path element, beyond its intended use as an indicator for paths relative to the user's home directory. The vulnerability was discovered by Harry Sintonen and publicly disclosed on March 20, 2023 (Curl Advisory).

The vulnerability exists in curl's SFTP implementation where the tilde (~) character is wrongly replaced when used as a prefix in the first path element. For example, when accessing a server using a user 'dan' (with home directory /home/dan), a path like /~2/foo would incorrectly resolve to /home/dan2/foo instead of being properly handled. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, NetApp Advisory).

The vulnerability could allow attackers to bypass filtering mechanisms or execute arbitrary code by crafting specific paths while accessing a server. This could potentially lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

The vulnerability requires an attacker to have access to make SFTP requests to the affected system. Public exploit discussions have been acknowledged by security vendors, and the vulnerability has been demonstrated to be exploitable in real-world scenarios (NetApp Advisory).

The vulnerability has been fixed in curl version 8.0.0 and later. Users are strongly recommended to upgrade to the latest version. For systems that cannot be immediately upgraded, there is no known workaround at this time (Curl Advisory, Gentoo Advisory).