CVE-2025-15224CWE-287
CVE-2025-15224
Low · published January 8, 2026
What it is
When doing SSH-based transfers using either SCP or SFTP, and asked to do
public key authentication, curl would wrongly still ask and authenticate using
a locally running SSH agent.
The record
Technical detail
- CVSS v3.1
- 3.1 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00480 · 40.4th percentile
- Weakness
- CWE-287 · Improper Authentication
- Published
- 2026-01-08T15:15Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| haxx/curl | ≥ 7.58.0, < 8.18.0 | 8.18.0 |
References (4)
EPSS history
Timeline