Live › vulnerability › CVE-2026-118485
Go to dashboardAxel 2.17.14 and earlier percent-decode the output filename after parsing a URL, so encoded ../ sequences turn into directory traversal. A crafted download URL can make axel write downloaded content to arbitrary paths relative to the current directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 12:32 UTC. All times on this page are UTC.
Teams that run axel on URLs they do not fully control, such as download scripts, CI jobs or tools that fetch user-supplied links. Machines where axel is installed but never fed external URLs carry little practical exposure. The sources do not say which distributions package the affected versions.
No product ranges from the sources yet.
axel --version (or check the installed package version) and compare with the affected range 2.17.14 and earlier.2.17.14; the sources do not name the fixed version, so check the upstream project for the patched release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-118485")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.