CVE-2025-11563 wcurl path traversal with percent-encoded slashes
Attackers can trick wcurl into saving files outside the current directory using percent-encoded slashes, potentially overwriting unintended files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11563?
CVE-2025-11563 is a medium-severity path traversal vulnerability in curl, published on 25 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.
This flaw only affects the wcurl command line tool.
Weakness: CWE-22
Which versions are affected by CVE-2025-11563?
It affects 1 product.
Linux distribution packages (9)
curl SUSE:Linux Enterprise Micro 5.2 | All versions | 8.14.1-150200.4.94.1 |
curl SUSE:Linux Enterprise Micro 5.3 | All versions | 8.14.1-150400.5.72.1 |
curl SUSE:Linux Enterprise Micro 5.4 | All versions | 8.14.1-150400.5.72.1 |
curl SUSE:Linux Enterprise Micro 5.5 | All versions | 8.14.1-150400.5.72.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 8.14.1-150600.4.31.1 |
curl SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 8.14.1-150700.7.5.1 |
curl SUSE:Linux Micro 6.0 | All versions | 8.14.1-2.1 |
curl SUSE:Linux Micro 6.1 | All versions | 8.14.1-slfo.1.1_3.1 |
curl openSUSE:Leap 15.6 | All versions | 8.14.1-150600.4.31.1 |
Products include Curl Wcurl.
How do I fix CVE-2025-11563?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-11563 being exploited?
There is no known exploitation of CVE-2025-11563 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-11563, DEBIAN-CVE-2025-11563, ECHO-f069-94fc-237e, GHSA-6xq2-fm6w-mxfm, JLSEC-2026-425, SUSE-SU-2025:21198-1 and 6 more.