CVE-2025-11563

Description

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

CVSS Metrics

• v3.1•MEDIUM•Score: 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.30%• Percentile: 22%

Techniques & Countermeasures

• CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected Systems

• curl•curl

  8.17.0 | 8.16.0 | 8.15.0 | 8.14.1 | 8.14.0

• curl•wcurl

  ≥ 2024-12-08, < 2025-11-09

References (4)

• https://curl.se/docs/CVE-2025-11563.json
• https://curl.se/docs/CVE-2025-11563.html
• http://www.openwall.com/lists/oss-security/2025/11/04/1
• https://lists.debian.org/debian-release/2025/11/msg00504.html