CVE-2026-118485High· 8.1▾ TwilightAxel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encode…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
Axel <= 2.17.14Apply patch provided by Axel. Will be fixed in 2.17.16 as well
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41082High· 7.3In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
CVE-2026-90721Low· 3.4Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-108980High· 8.8Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin
CVE-2026-92533High· 7.1Path traversal vulnerability in the BugTracker.NET file download component
CVE-2026-105314High· 7.5Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
CVE-2026-104994Low· 2.5Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root