Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
[SECURITY ADVISORY] wcurl path traversal with percent-encoded slashes
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-users <curl-users_at_lists.haxx.se>
Date: Tue, 4 Nov 2025 09:42:02 +0100 (CET)
wcurl path traversal with percent-encoded slashes
=================================================
Project curl Security Advisory, November 4 2025 -
[Permalink](https://curl.se/docs/CVE-2025-11563.html)
VULNERABILITY
-------------
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into
saving the output file outside of the current directory without the user
explicitly asking for it.
INFO
Date: Tue, 4 Nov 2025 09:42:02 +0100 (CET)
wcurl path traversal with percent-encoded slashes
=================================================
Project curl Security Advisory, November 4 2025 -
[Permalink](https://curl.se/docs/CVE-2025-11563.html)
VULNERABILITY
-------------
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into
saving the output file outside of the current directory without the user
explicitly asking for it.
INFO
---- wcurl will not overwrite any files if the curl version is >= 7.83. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2025-11563 to this issue. CWE-35: Path Traversal Severity: Moderate AFFECTED VERSIONS ----------------- - Affected versions: wcurl shipped with curl 8.14.0 to and including 8.16.0 - Affected versions: wcurl 2024.12.08 to and including 2025.09.27 - Not affected versions: wcurl shipped with curl < 8.14.0 and >= 8.17.0 - Not affected versions: wcurl < 2024.12.08 and >= 2025.11.04 - Introduced-in: https://github.com/curl/wcurl/commit/e01d578582a23695ee3cec08 - Introduced-in: https://github.com/curl/curl/commit/23bed347b3892277938259 This flaw only affects the wcurl command line tool. SOLUTION ------------ Starting in wcurl 2025.11.04 (shipped with curl 8.17.0), this mistake is fixed. - Fixed-in: https://github.com/curl/wcurl/commit/524f7e733237cd26553dfd - Fixed-in: https://github.com/curl/curl/commit/fb0c014e30e5f4de7aa0d566c RECOMMENDATIONS -------------- A - Upgrade wcurl to the one shipped in curl version 8.17.0, wcurl to version 2025.11.04 B - Apply the patch to your local wcurl version C - Explicitly choose an output filename with `-o/-O/--output` D - Disable percent-decoding for output filenames with `--no-decode-filename` TIMELINE -------- This issue was reported to the curl project on October 6, 2025. We contacted distros_at_openwall on October 30. wcurl 2025.11.04 was released on November 4 2025, coordinated with the publication of this advisory. curl 8.17.0 was released on November 5 2025. The curl security team is not aware of any active exploits using this vulnerability. CREDITS ------- - Reported-by: Stanislav Fort (Aisle Research) - Patched-by: Samuel Henrique - Patched-by: Sergio Durigan Junior Thanks a lot! -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2025-11-04