CVE-2026-118485

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisories.orangecyberdefense.com/advisories/167
https://github.com/axel-download-accelerator/axel/issues/477
https://github.com/axel-download-accelerator/axel/milestone/22
https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e

Configurations

No configuration.

History

28 Oct 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 12:17

Updated : 2026-10-28 15:24

NVD link : CVE-2026-118485

Mitre link : CVE-2026-118485

CVE.ORG link : CVE-2026-118485

JSON object : View

Products Affected

No product.

CWE

CWE-24

Path Traversal: '../filedir'

{"id": "CVE-2026-118485", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "affectedData": [{"repo": "https://github.com/axel-download-accelerator/axel/", "vendor": "Axel Download Accelerator", "product": "Axel", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "2.17.14"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-28T12:17:40.370", "references": [{"url": "https://advisories.orangecyberdefense.com/advisories/167", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd"}, {"url": "https://github.com/axel-download-accelerator/axel/issues/477", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd"}, {"url": "https://github.com/axel-download-accelerator/axel/milestone/22", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd"}, {"url": "https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "description": [{"lang": "en", "value": "CWE-24"}]}], "descriptions": [{"lang": "en", "value": "Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory."}], "lastModified": "2026-10-28T15:24:56.033", "sourceIdentifier": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd"}