The vulnerability arises when an FTP transfer configured with CURLUSESSL_NONE reuses a pooled FTP control connection that was previously upgraded with STARTTLS and authenticated using a client certificate. The second operation does not perform a new TLS handshake or FTP login, so the server continues to authorize it under the first handle’s certificate identity. This results in unauthorized access, allowing an attacker to act with the privileges of the original certificate, potentially reading, modifying, or deleting files that should be protected.

The affected product is curl. Version information is not disclosed by the CNA, so the specific releases impacted are unknown. The flaw affects the FTP handling component within curl.

The CVSS score of 9.1 indicates high severity. The EPSS score is less than 1%, suggesting a low probability of current exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is remote FTP: an attacker that can establish an FTP control connection with client‑certificate authentication can reuse that session without a new TLS handshake or login, thereby gaining unauthorized privileges on the server. Exploitation requires an FTP server that accepts client certificates and permits session reuse, and no additional credentials are necessary beyond establishing the original connection.