CVE-2026-118485
Axel Download Accelerator Path Traversal via URL Filename Decoding
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
| CWE | CWE-24 |
| Vendor | axel download accelerator |
| Product | axel |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for axel download accelerator axel
Be the first to know when new high vulnerabilities affecting axel download accelerator axel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
Axel Download Accelerator / Axel
0 ≤ 2.17.14
References
github.com: https://github.com/axel-download-accelerator/axel/issues/477 github.com: https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e github.com: https://github.com/axel-download-accelerator/axel/milestone/22 advisories.orangecyberdefense.com: https://advisories.orangecyberdefense.com/advisories/167
Credits
Guillaume Meunier from Orange Cyberdefense CERT VOC Team