The cURL development team has confirmed that file:// protocol support is a , not a vulnerability. However, when this feature is misused—whether accidentally or maliciously—it provides direct access to any local file the executing user has permission to read.

This works because curl automatically decodes the URL handling the scheme.

If you are looking to work with files using curl , these are the standard flags:

Systems that can't handle those slashes in a filename might rename the resulting log to something like curl-url-file-3A-2F-2F-2F... to keep the record clear.