JLSEC-2026-425 URLs containing percent-encoded slashes (`/` or `\ `) can trick wcurl into saving the output file...

URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...

CVE-2025-11563

URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...

CVE-2025-11563 wcurl path traversal with percent-encoded slashes

URLs containing percent-encoded slashes / or \ can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool...

CVE-2025-11563

The wcurl command line tool is vulnerable to a path traversal flaw when processing URLs containing percent-encoded slashes (/ or \). The root cause is located in the get_url_filename() function, which fails to properly restrict literal backslashes, allowing an attacker-controlled URL to trick the...