CVE-2026-118485 Axel Download Accelerator Path Traversal via URL Filename Decoding
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118485?
CVE-2026-118485 is a high-severity vulnerability in Axel, published on 28 Oct 2026.
Official description
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
Weakness: CWE-24
Which versions are affected by CVE-2026-118485?
How do I fix CVE-2026-118485?
No fix has been published for CVE-2026-118485 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118485 being exploited?
There is no known exploitation of CVE-2026-118485 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118485, GHSA-gww9-3rx9-535x.