CVE-2026-118485

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

CVE-2026-118485 Axel Download Accelerator Path Traversal via URL Filename Decoding

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

CVE-2026-118485

Axel Download Accelerator versions 2.17.14 and earlier are vulnerable to a path traversal vulnerability (CWE-24) caused by improper URL percent-decoding. The software performs http_decode() on the output filename after the URL has been parsed. This allows an attacker to use encoded sequences like...

EUVD-2026-112024

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

PT-2026-128213

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding http decode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...