{"id":"CVE-2026-118485","title":"Axel Download Accelerator Path Traversal via URL Filename Decoding","summary":"Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encode…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-24"],"vendor":"Axel Download Accelerator","product":"Axel","affected":["Axel <= 2.17.14"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T11:26:59.053Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118485","references":[{"url":"https://github.com/axel-download-accelerator/axel/issues/477"},{"url":"https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e"},{"url":"https://github.com/axel-download-accelerator/axel/milestone/22"},{"url":"https://advisories.orangecyberdefense.com/advisories/167"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T12:10:35.158Z","slug":"CVE-2026-118485","body":"## Overview\n\nAxel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.\n\n## Affected\n\n- `Axel <= 2.17.14`\n\n## Remediation\n\nApply patch provided by Axel. Will be fixed in 2.17.16 as well","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}