CVE-2025-11563

wcurl path traversal with percent-encoded slashes

Medium · published February 25, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into

saving the output file outside of the current directory without the user

explicitly asking for it.

This flaw only affects the wcurl command line tool.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Published
2026-02-25T07:20Z
EPSS history
Timeline
  • 25 FEB 07:20Z
    wcurl path traversal with percent-encoded slashes
    cvelistv5