---
id: CVE-2026-118485
title: Axel Download Accelerator Path Traversal via URL Filename Decoding
summary: >-
  Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding
  (http_decode()) on the output filename after the URL has been parsed and the
  filename component extracted. This allows an attacker to embed %2e%2e%2f
  (URL-encode…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-24
vendor: Axel Download Accelerator
product: Axel
affected:
  - Axel <= 2.17.14
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T11:26:59.053Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118485'
references:
  - url: 'https://github.com/axel-download-accelerator/axel/issues/477'
  - url: >-
      https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e
  - url: 'https://github.com/axel-download-accelerator/axel/milestone/22'
  - url: 'https://advisories.orangecyberdefense.com/advisories/167'
tags:
  - cve.org
ingestedAt: '2026-10-28T12:10:35.158Z'
---

## Overview

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.

## Affected

- `Axel <= 2.17.14`

## Remediation

Apply patch provided by Axel. Will be fixed in 2.17.16 as well