CVE-2026-118485 Details
Description
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
A path traversal vulnerability has been identified in Axel Download Accelerator versions through 2.17.14. The issue arises because the application performs URL percent-decoding on the output filename after the URL has been parsed. This allows attackers to embed URL-encoded directory traversal sequences, which are decoded and can manipulate file write locations. Consequently, crafted URLs can direct downloaded content to arbitrary paths relative to the current working directory.
Users are advised to update to Axel Download Accelerator version 2.17.16, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://advisories.orangecyberdefense.com/advisories/167 | OCD | AdvisoryRemedy |
| https://github.com/axel-download-accelerator/axel/issues/477 | OCD | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/axel-download-accelerator/axel/milestone/22 | OCD | Vendor |
| https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e | OCD | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-24 | Path Traversal: '../filedir' | OCD |
Affected Products
| Product | Versions |
|---|---|
| Axel Download Accelerator | <= 2.17.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | OCD |