wcurl path traversal with percent-encoded slashes (CVE-2025-11563)

Summary

wcurl path traversal with percent-encoded slashes

Original description

The description as published by the source.

URLs containing percent-encoded slashes (/ or \) can trick wcurl into
saving the output file outside of the current directory without the user
explicitly asking for it.

This flaw only affects the wcurl command line tool.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2025-11563 curl Fixed in: 8.14.1-2+deb13u2

References

advisory github.com
advisory lists.debian.org
advisory nvd.nist.gov
web openwall.com
web curl.se
web curl.se