Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

curlrequest lets attackers read any file

CVE-2020-7646 · published 6 years ago
Summary

The curlrequest code up through version 1.0.1 will open and return the contents of any file whose name is supplied in the request. This means a user who can send a request could view sensitive files on your server. Upgrade to a newer version or stop using curlrequest to stop the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm cohara87 curlrequest <= 1.0.1
– curlrequest_project curlrequest <= 1.0.1
cpe:2.3:a:curlrequest_project:curlrequest:*:*:*:*:*:node.js:*:*
Original advisory text
curlrequest allows execution of arbitrary commands
curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published7 May 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m8xj-5v73-3hh8 · GHSA
CVE-2020-7646 · NVD
GHSA-m8xj-5v73-3hh8 · OSV
Track software like this
Free during beta