{"affected":[{"defaultStatus":"unaffected","product":"Axel","source":"CNA: OCD","vendor":"Axel Download Accelerator","versions":[{"lessThanOrEqual":"2.17.14","status":"affected","version":"0","versionType":"git"}]}],"cveId":"CVE-2026-118485","cwes":["CWE-24"],"description":"Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.","epss":{"date":"2026-11-06","percentile":0.4677,"score":0.0056},"exploits":[],"kev":null,"metrics":[{"score":7,"severity":"high","source":"CNA: OCD","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.1,"severity":"high","source":"CNA: OCD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1793990256239,"publishedAt":1793186819053,"references":[{"source":"CNA: OCD","tags":["issue-tracking"],"url":"https://github.com/axel-download-accelerator/axel/issues/477"},{"source":"CNA: OCD","tags":["patch"],"url":"https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e"},{"source":"CNA: OCD","tags":["vendor-advisory"],"url":"https://github.com/axel-download-accelerator/axel/milestone/22"},{"source":"CNA: OCD","tags":["third-party-advisory"],"url":"https://advisories.orangecyberdefense.com/advisories/167"}],"remediation":[{"kind":"fix","source":"CNA: OCD","text":"Apply patch provided by Axel. Will be fixed in 2.17.16 as well"},{"kind":"fix","source":"CNA: OCD","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e"}],"revision":"9ddb9c0b5c5d1755dfa9fa1aa8a62bc9fffdf6168830e6e671712ccb298f00c1","sources":[{"modifiedAt":1793990256239,"name":"CNA: OCD","retrievedAt":1793992207428,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118485"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793992212505,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118485"}],"ssvc":{"assessedAt":1793988891282,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Axel Download Accelerator Path Traversal via URL Filename Decoding","updatedAt":1793992212505}