CVE-2026-118485
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Oct 28, 2026
CISA due date
—
The record
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-90721 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-24
- CVE-2026-14947 A high-privileged remote attacker can upload malicious ZIP archive containing directory… CWE-24
- CVE-2026-76353 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-24
- CVE-2026-73573 In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in… CWE-24
- CVE-2026-48047 XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. CWE-24
- CVE-2026-66140 Exim before 4.99.5 allows directory traversal to access files outside of the spool area… CWE-24
- CVE-2026-44942 A path traversal in handling the "path" component of .repo files processed by libzypp… CWE-24
- CVE-2026-49103 Webmin before 2.640 does not safely construct a filename for saving of an attachment… CWE-24