CVE-2025-11563
Medium · 4.6CVSS
4.6
EPSS
0.4%
Published
Feb 25, 2026
CISA due date
—
The record
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | curl | 0 | 8.14.1-150200.4.94.1 |
| SUSE:Linux Enterprise Micro 5.3 | curl | 0 | 8.14.1-150400.5.72.1 |
| SUSE:Linux Enterprise Micro 5.4 | curl | 0 | 8.14.1-150400.5.72.1 |
| SUSE:Linux Enterprise Micro 5.5 | curl | 0 | 8.14.1-150400.5.72.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | curl | 0 | 8.14.1-150600.4.31.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | curl | 0 | 8.14.1-150700.7.5.1 |
| openSUSE:Leap 15.6 | curl | 0 | 8.14.1-150600.4.31.1 |
| openSUSE:Leap 16.0 | curl | 0 | 8.14.1-160000.3.1 |
| openSUSE:Tumbleweed | curl | 0 | 8.17.0-1.1 |
Related vulnerabilities
- CVE-2026-3783 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a… Also affects curl
- CVE-2026-3784 curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server… Also affects curl
- CVE-2026-3805 When doing a second SMB request to the same host again, curl would wrongly use a data… Also affects curl
- CVE-2026-1965 libcurl can in some circumstances reuse the wrong connection when asked to do an… Also affects curl
- CVE-2024-11053 When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl… Also affects curl
- CVE-2024-8096 When curl is told to use the Certificate Status Request TLS extension, often referred to… Also affects curl
- CVE-2023-46218 This flaw allows a malicious HTTP server to set "super cookies" in curl that are then… Also affects curl
- CVE-2023-38546 This flaw allows an attacker to insert cookies at will into a running program using… Also affects curl