---
id: "CVE-2026-118485"
kind: "vulnerability"
aliases: ["CVE-2026-118485"]
title: "Axel download accelerator: crafted URLs write files outside the working directory"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["axel", "ci", "linux", "package", "scripts"]
not_affected_if: ["no-untrusted-urls", "other-download-tool"]
published_at: "2026-10-28T12:17:40+00:00"
first_seen_at: "2026-10-28T12:32:51+00:00"
updated_at: "2026-10-28T12:33:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118485", "first_seen_at": "2026-10-28T12:32:51+00:00"}]
---

# Axel download accelerator: crafted URLs write files outside the working directory

Axel 2.17.14 and earlier percent-decode the output filename after parsing a URL, so encoded ../ sequences turn into directory traversal. A crafted download URL can make axel write downloaded content to arbitrary paths relative to the current directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `axel --version` (or check the installed package version) and compare with the affected range `2.17.14` and earlier.
- Review any scripts that run axel on URLs from untrusted sources, looking for use of the output filename option or default naming.

## Fix

- Upgrade axel to a release newer than `2.17.14`; the sources do not name the fixed version, so check the upstream project for the patched release.
- Until patched, do not feed axel URLs from untrusted sources, or run it inside a dedicated empty directory.

## Timeline

- 2026-10-28T12:32:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118485

## From the sources

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_