CVE-2026-118485

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118485", "assignerOrgId": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "state": "PUBLISHED", "assignerShortName": "OCD", "dateReserved": "2026-10-28T11:13:12.954Z", "datePublished": "2026-10-28T11:26:59.053Z", "dateUpdated": "2026-11-06T18:37:36.239Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "shortName": "OCD", "dateUpdated": "2026-10-28T11:26:59.053Z"}, "title": "Axel Download Accelerator Path Traversal via URL Filename Decoding", "datePublic": "2026-10-28T11:25:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-24", "description": "CWE-24 Path traversal: '../filedir'", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "Axel Download Accelerator", "product": "Axel", "repo": "https://github.com/axel-download-accelerator/axel/", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2.17.14", "versionType": "git"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:axel_download_accelerator:axel:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "2.17.14"}]}]}], "descriptions": [{"lang": "en", "value": "Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory."}]}], "references": [{"url": "https://github.com/axel-download-accelerator/axel/issues/477", "tags": ["issue-tracking"]}, {"url": "https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e", "tags": ["patch"]}, {"url": "https://github.com/axel-download-accelerator/axel/milestone/22", "tags": ["vendor-advisory"]}, {"url": "https://advisories.orangecyberdefense.com/advisories/167", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Apply patch provided by Axel. Will be fixed in 2.17.16 as well", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Apply patch provided by Axel. Will be fixed in 2.17.16 as well"}]}], "timeline": [{"time": "2026-02-27T23:00:00.000Z", "lang": "en", "value": "Vulnerability found"}, {"time": "2026-03-03T16:01:00.000Z", "lang": "en", "value": "Vulnerability disclosed to Axel"}, {"time": "2026-07-22T06:52:00.000Z", "lang": "en", "value": "Patch released"}, {"time": "2026-10-28T11:25:00.000Z", "lang": "en", "value": "Vulnerability disclosed"}], "credits": [{"lang": "en", "value": "Guillaume Meunier from Orange Cyberdefense CERT VOC Team", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T18:14:51.282247Z", "id": "CVE-2026-118485", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:37:36.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118485", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T18:14:51.282247Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:37:29.959Z"}}], "cna": {"title": "Axel Download Accelerator Path Traversal via URL Filename Decoding", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Guillaume Meunier from Orange Cyberdefense CERT VOC Team"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/axel-download-accelerator/axel/", "vendor": "Axel Download Accelerator", "product": "Axel", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "2.17.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-27T23:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-03-03T16:01:00.000Z", "value": "Vulnerability disclosed to Axel"}, {"lang": "en", "time": "2026-07-22T06:52:00.000Z", "value": "Patch released"}, {"lang": "en", "time": "2026-10-28T11:25:00.000Z", "value": "Vulnerability disclosed"}], "solutions": [{"lang": "en", "value": "Apply patch provided by Axel. Will be fixed in 2.17.16 as well", "supportingMedia": [{"type": "text/html", "value": "Apply patch provided by Axel. Will be fixed in 2.17.16 as well", "base64": false}]}], "datePublic": "2026-10-28T11:25:00.000Z", "references": [{"url": "https://github.com/axel-download-accelerator/axel/issues/477", "tags": ["issue-tracking"]}, {"url": "https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e", "tags": ["patch"]}, {"url": "https://github.com/axel-download-accelerator/axel/milestone/22", "tags": ["vendor-advisory"]}, {"url": "https://advisories.orangecyberdefense.com/advisories/167", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.", "supportingMedia": [{"type": "text/html", "value": "Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-24", "description": "CWE-24 Path traversal: '../filedir'"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axel_download_accelerator:axel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.17.14", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "shortName": "OCD", "dateUpdated": "2026-10-28T11:26:59.053Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118485", "state": "PUBLISHED", "dateUpdated": "2026-11-06T18:37:36.239Z", "dateReserved": "2026-10-28T11:13:12.954Z", "assignerOrgId": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "datePublished": "2026-10-28T11:26:59.053Z", "assignerShortName": "OCD"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Axel", "repo": "https://github.com/axel-download-accelerator/axel/", "vendor": "Axel Download Accelerator", "versions": [{"lessThanOrEqual": "2.17.14", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory."}], "id": "CVE-2026-118485", "lastModified": "2026-11-06T19:17:38.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118485", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T18:14:51.282247Z", "version": "2.0.3"}}]}, "published": "2026-10-28T12:17:40.370", "references": [{"source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "url": "https://advisories.orangecyberdefense.com/advisories/167"}, {"source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "url": "https://github.com/axel-download-accelerator/axel/issues/477"}, {"source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "url": "https://github.com/axel-download-accelerator/axel/milestone/22"}, {"source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "url": "https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e"}], "sourceIdentifier": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-24"}], "source": "6064c9f1-42e5-4cc5-a67a-1636d7a9d3fd", "type": "Secondary"}]}

{"bugzilla": {"description": "axel: axel: Arbitrary file write via directory traversal in URL path", "id": "2568431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568431"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.", "A flaw was found in axel. A remote attacker can cause the application to write downloaded content to arbitrary file system locations by enticing a user to download a file from a specially crafted URL. Because the application processes URL-encoded directory traversal sequences (such as \"../\") after parsing the URL path, malicious path components bypass initial validation before the output file is created. This vulnerability can lead to unauthorized file overwrites or data tampering within directories accessible to the user."], "mitigation": {"lang": "en:us", "value": "Explicitly define the destination filename when invoking axel or restrict the process execution environment.\n1. Specify a local target file using the `-o` option to prevent axel from deriving the filename from the URL path:\n```\naxel -o /path/to/downloaded_file \"https://example.com/untrusted/url\"\n```\n2. Alternatively, run the utility from an isolated temporary directory or within an unprivileged sandbox container where write access to sensitive files is restricted.\nCaveats:\nPassing a directory path rather than an explicit file name to the `-o` option still causes axel to infer the filename from the URL, which does not mitigate the vulnerability. Ensure an explicit file name is always designated.\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to decode the complete URL path and extract only the final basename component prior to opening destination files in axel: upgrade to Axel 2.17.16 (or the fixed Axel builds), which decode the full URL path before isolating the final basename component using conn_output_filename, closing URL-encoded directory traversal sequences in URL path. Until patched, this is a concern on Any environment where axel downloads files from untrusted URLs without an explicit target filename specified via -o, so Always specify an explicit destination file name using the -o option, or execute axel inside an isolated temporary directory or unprivileged sandbox container. As a compensating measure, Validate the derived filename against an allowlist of permissible characters, rejecting directory separators and traversal patterns, Use an EDR agent to detect behavioral anomalies when a client utility writes or overwrites sensitive files outside standard download directories, Use Falco / eBPF runtime security to detect anomalous writes to critical filesystem locations initiated by the axel user process, and Use AIDE / File Integrity Monitoring to detect unauthorized modifications or overwrites of monitored baseline system files resulting from path traversal. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)"}, "name": "CVE-2026-118485", "public_date": "2026-10-28T11:26:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118485\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118485\nhttps://advisories.orangecyberdefense.com/advisories/167\nhttps://github.com/axel-download-accelerator/axel/issues/477\nhttps://github.com/axel-download-accelerator/axel/milestone/22\nhttps://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e"], "statement": "Red Hat has rated this vulnerability as having an Important severity because it enables arbitrary file overwrite with the permissions of the invoking user, potentially compromising system integrity or critical configurations. Although exploitation requires user interaction to target a malicious URL, successful exploitation allows remote attackers to place arbitrary files outside the intended download directory without authentication. In typical Red Hat environments, axel is a command-line download utility that is not invoked as a background service or with elevated privileges by default, which bounds the blast radius to the user's execution context.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.17.14]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Axel", "source": "cna", "vendor": "Axel Download Accelerator"}, "product": "axel", "vendor": "axel_download_accelerator"}], "created": "2026-10-28T12:15:14.879177+00:00", "updated": "2026-11-10T09:24:54.564371+00:00", "vendors": ["axel_download_accelerator", "axel_download_accelerator$PRODUCT$axel"]}