Vulnerability · Published Oct 28, 2026 · Assigned by OCD

CVE-2026-118485Axel Download Accelerator Path Traversal via URL Filename Decoding

High 8.1

In plain English

A high-severity security flaw in Axel from Axel Download Accelerator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 53.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	axel	no fix listed	DEBIAN-CVE-2026-118485
Debian:13	axel	no fix listed	DEBIAN-CVE-2026-118485
Debian:14	axel	no fix listed	DEBIAN-CVE-2026-118485

Affected products (as reported)

Vendor	Product	Versions
Axel Download Accelerator	Axel	0 – through 2.17.14

Weakness: CWE-24 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

https://github.com/axel-download-accelerator/axel/issues/477 issue-tracking
https://github.com/axel-download-accelerator/axel/pull/483/changes/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e patch
https://github.com/axel-download-accelerator/axel/milestone/22 vendor-advisory
https://advisories.orangecyberdefense.com/advisories/167 third-party-advisory