curl / Docs / curl CVEs / CVE-2026-80256
Related:
Audits
Changelog
curl CVEs
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-80256

wcurl backslash bypass

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

A flaw in how wcurl handles backslashes makes it possible to create a new attacker-controlled file outside the directory chosen by the Windows user. Percent-encoded backslashes are decoded, leading to the output file being saved in a folder other than the one wcurl is being invoked from.

INFO

The new file is subject to the user's filesystem permissions and the target not already existing; modern curl's --no-clobber option prevents overwriting an existing target.

This bug exists only on Windows.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-80256 to this issue.

CWE-35: Path Traversal

Severity: Medium

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

A - Upgrade wcurl to the one shipped in curl version 8.22.0, wcurl to version 2026.08.30

B - Apply the patch to your local wcurl version

C - Explicitly choose an output filename with -o/-O/--output

D - Explicitly disable percent-decoding for the output filename with --no-decode-filename

TIMELINE

This issue was reported to the curl project on August 25, 2026.

wcurl 2026.08.30 was released on August 30 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!