Bug 2568431 (CVE-2026-118485)

Summary: CVE-2026-118485 axel: axel: Arbitrary file write via directory traversal in URL path
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in axel. A remote attacker can cause the application to write downloaded content to arbitrary file system locations by enticing a user to download a file from a specially crafted URL. Because the application processes URL-encoded directory traversal sequences (such as "../") after parsing the URL path, malicious path components bypass initial validation before the output file is created. This vulnerability can lead to unauthorized file overwrites or data tampering within directories accessible to the user.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2569205    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-06 18:41:28 UTC 
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.