CVE-2026-118485: Axel Download Accelerator Path Traversal via URL Filename Decoding
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (httpdecode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Axel Download Acceleratorto a version that resolves this vulnerability.Fixed in 2.17.16
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Axel Download Accelerator 2.17.14 and earlier are exposed when they download a crafted URL. The impact is limited to filesystem paths reachable relative to Axel's current working directory.
What must an attacker do to exploit it?
An attacker needs to cause a user to download a URL whose path includes percent-encoded traversal sequences such as %2e%2e%2f. User interaction is required because the crafted URL must be downloaded by Axel.
What could an attacker accomplish?
The downloaded content can be written to an arbitrary path relative to the current working directory, rather than to the expected output filename. This can affect file integrity and availability.