CVE-2025-11563

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

Affected products

Linuxmint, Red Os, Ubuntu, Curl

Curl Wcurl

< 2025-11-09

Fix

Available

CVSS 3.1

4.6 MEDIUM

EPSS

0.3% (23th percentile)

Weakness

CWE-22

NVD status

Analyzed

Published

2026-02-25

No exploit for CVE-2025-11563 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.