CVEvulnerability
CVE-2025-11563
4.6 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-25
- Last modified
- 2026-06-17
- Assigner
- 2499f714-1537-4658-8207-48ae4bb9eae9
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-22
Description
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into
saving the output file outside of the current directory without the user
explicitly asking for it.
This flaw only affects the wcurl command line tool.
Affected configurations
• curl wcurl (>= 2024-12-08 < 2025-11-09)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://curl.se/docs/CVE-2025-11563.html Patch, Vendor Advisory
- https://curl.se/docs/CVE-2025-11563.json Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/11/04/1 Mailing List, Third Party Advisory
- https://lists.debian.org/debian-release/2025/11/msg00504.html Mailing List, Patch, Third Party Advisory