The vulnerability arises in curl when it is invoked with the remote header name option that is intended to protect existing files from being overwritten. A malicious server can bypass this no‑clobber guarantee by returning an intermediate HTTP 103 Early Hints response, or by ordering headers so that an ETag header is processed before the Content‑Disposition header under --etag‑save, tricking curl into treating an existing file as a new download. This allows an attacker who controls the remote server to overwrite any file that curl creates on the client system during a transfer.

The affected product is curl, a widely used command‑line HTTP client. The specific vendor and item versions are not identified in the data provided, but any installation that uses the -J option or implements the associated no‑clobber logic is potentially vulnerable.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of < 1% (0.00257) indicates a very low exploitation probability, and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The most likely attack vector involves a remote server having control over HTTP responses sent to a client that uses curl to fetch resources. If that server is trusted or if the client indiscriminately downloads from untrusted origins, the attacker can overwrite arbitrary files on the client’s filesystem, potentially compromising system integrity.