Search
Search is not available in local development.
Run npx pagefind --site __site after building to enable it.
JLSEC-2026-425 Medium 4.6

URLs containing percent-encoded slashes (`/` or `\ `) can trick wcurl into saving the output file...

SourceEditHistoryOSVJSON (OSV)
JLSEC Published
Modified
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected Packages
CURL_jll >= 8.16.0+0, < 8.17.0+0
LibCURL_jll >= 8.15.0+0, < 8.17.0+0
Upstream
CVE-2025-11563 GHSA-6xq2-fm6w-mxfm EUVD-2025-208109

URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.

This flaw only affects the wcurl command line tool.

References