CVE-2022-32207

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

12% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-25)

CWEs

CWE-276, CWE-840

Published

2022-07-07

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• apple:macos
• debian:debian_linux
• fedoraproject:fedora
• haxx:curl
• netapp:bootstrap_os
• netapp:clustered_data_ontap
• netapp:element_software
• netapp:h300s_firmware
• netapp:h410s_firmware
• netapp:h500s_firmware
• netapp:h700s_firmware
• netapp:hci_management_node
• netapp:solidfire
• splunk:universal_forwarder

References

• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/41
• https://hackerone.com/reports/1573634
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
• https://security.gentoo.org/glsa/202212-01

Check your stackJSON