URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.
This flaw only affects the wcurl command line tool.
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade libcurl-develUpgrade curl-debuginfoUpgrade libcurl | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade curl-debugsourceUpgrade libcurl-develUpgrade libcurlUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-debuginfoUpgrade curl-minimal-debuginfoUpgrade curl-minimalUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimal | Feb 26, 2026 | Feb 25, 2026 |
| Debian | — | Upgrade curl | Jul 23, 2026 | Jul 23, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Ubuntu | — | Upgrade libcurl4-gnutls-devUpgrade libcurl4-nss-devUpgrade libcurl4-openssl-devUpgrade libcurl3-nssUpgrade curlUpgrade libcurl3t64-gnutlsUpgrade libcurl4Upgrade libcurl4t64Upgrade libcurl3-gnutls | Feb 26, 2026 | Feb 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub