{"id":"CVE-2026-118485","published":"2026-10-28T12:17:40.370","lastModified":"2026-10-28T15:24:56.033","description":"Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwes":["CWE-24"],"vendors":[],"products":[],"references":[{"url":"https://advisories.orangecyberdefense.com/advisories/167","tags":[]},{"url":"https://github.com/axel-download-accelerator/axel/issues/477","tags":[]},{"url":"https://github.com/axel-download-accelerator/axel/milestone/22","tags":[]},{"url":"https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e","tags":[]}],"exploitRefs":[{"url":"https://github.com/axel-download-accelerator/axel/issues/477","tags":[]},{"url":"https://github.com/axel-download-accelerator/axel/milestone/22","tags":[]},{"url":"https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e","tags":[]}],"hasPoc":true,"ai":null}