CVE-2025-11563

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.

This flaw only affects the wcurl command line tool.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
curl	curl	>= 8.17.0, <= 8.17.0; >= 8.16.0, <= 8.16.0; >= 8.15.0, <= 8.15.0; >= 8.14.1, <= 8.14.1; >= 8.14.0, <= 8.14.0

References

https://curl.se/docs/CVE-2025-11563.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2025-11563.jsonVendor Advisory
http://www.openwall.com/lists/oss-security/2025/11/04/1Mailing List, Third Party Advisory
https://lists.debian.org/debian-release/2025/11/msg00504.htmlMailing List, Patch, Third Party Advisory

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-115645.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missin CVE-2025-115657.3CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system CVE-2025-115666.9CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to CVE-2025-115677.3CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is n CVE-2025-115684.4A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker wit CVE-2025-11576.3A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the CVE-2025-115704.6Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficie CVE-2025-115712.1Vulnerable endpoints accept user-controlled input through a URL in JSON format which enables command execution. The commands allowed to exec CVE-2025-115737.5An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a speciall CVE-2025-115757.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects Mongo CVE-2025-115764.3The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versi CVE-2025-115777.6Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Polic