CVE-2025-11563 — wcurl path traversal with percent-encoded slashes
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. Thi…
Published: 2026-02-25 · CVSS: 4.6 · CVSS 3.1
URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7