CVE-2026-118485
highAxel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filena…
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://advisories.orangecyberdefense.com/advisories/167 6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd
- https://github.com/axel-download-accelerator/axel/issues/477 6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd
- https://github.com/axel-download-accelerator/axel/milestone/22 6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd
- https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2... 6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd