CVE-2025-11563: Curl Wcurl Path Traversal Vulnerability

CVE-2025-11563 Overview

CVE-2025-11563 is a path traversal vulnerability affecting the wcurl command line tool. URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving output files outside of the current directory without explicit user consent. This vulnerability allows attackers to potentially overwrite arbitrary files on the system by manipulating URL paths with encoded directory traversal sequences.

Critical Impact

Attackers can exploit percent-encoded slashes in URLs to write files to arbitrary locations outside the intended working directory, potentially leading to file overwrite attacks or unauthorized file creation.

Affected Products

• curl wcurl (all versions prior to patch)
• haxx curl

Discovery Timeline

• 2025-02-25 - CVE CVE-2025-11563 published to NVD
• 2025-02-26 - Last updated in NVD database

Technical Details for CVE-2025-11563

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a weakness where the application fails to properly neutralize special elements in pathnames that could resolve to locations outside of a restricted directory. The wcurl command line tool processes URLs to determine output file paths, but does not adequately decode and validate percent-encoded characters before constructing the destination file path.

When a user provides a URL to wcurl, the tool extracts the filename component for saving the downloaded content. However, if the URL contains percent-encoded directory traversal sequences such as %2F (forward slash) or %5C (backslash), wcurl fails to recognize these as path separators. After decoding, these characters are interpreted by the filesystem, allowing the output file to be written outside the current working directory.

The attack requires network access and user interaction, as a victim must be tricked into running wcurl with a malicious URL. However, the low privilege requirements mean any user running wcurl could be affected.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and improper handling of percent-encoded characters in URL parsing. The wcurl tool decodes URL-encoded characters after determining the output path rather than before, creating a mismatch between the perceived safe filename and the actual path used by the filesystem. This allows encoded path traversal sequences to bypass security checks while still being interpreted as directory separators when the file is written.

Attack Vector

An attacker can craft a malicious URL containing percent-encoded path traversal sequences such as ..%2F or %2E%2E%5C that appear benign to wcurl's initial validation but resolve to parent directories when decoded. When a user executes wcurl with this crafted URL, the output file is written to an attacker-controlled location outside the intended download directory.

The attack scenario involves convincing a user to download content using wcurl with an attacker-controlled URL. This could occur through phishing, malicious documentation, or compromised package instructions. The vulnerability enables writing files to sensitive locations such as configuration directories or user startup scripts.

Detection Methods for CVE-2025-11563

Indicators of Compromise

• Unexpected files appearing in directories outside normal wcurl download locations
• Files with unusual names containing decoded path separators in system directories
• Audit logs showing wcurl processes writing to sensitive system paths
• Configuration files or scripts modified with unexpected content after wcurl operations

Detection Strategies

• Monitor file system activity for wcurl processes writing outside their working directory
• Implement command-line argument logging to capture URLs containing percent-encoded sequences like %2F, %2E%2E, or %5C
• Review security logs for signs of path traversal attempts in download tool operations
• Deploy endpoint detection rules that flag wcurl executions followed by file writes to system directories

Monitoring Recommendations

• Enable comprehensive process auditing on systems where wcurl is commonly used
• Configure file integrity monitoring on sensitive directories to detect unauthorized writes
• Implement network monitoring to identify connections to suspicious URLs containing encoded path sequences

How to Mitigate CVE-2025-11563

Immediate Actions Required

• Update wcurl to the latest patched version as recommended by the curl project
• Audit recent wcurl usage for any suspicious URLs containing percent-encoded characters
• Review file system changes in sensitive directories following any wcurl operations
• Consider temporarily restricting wcurl usage until patches are applied

Patch Information

The curl project has released security advisories and patches addressing this vulnerability. Administrators should consult the cURL CVE-2025-11563 Documentation for official patch information and upgrade instructions. Debian users should refer to the Debian Release Note for distribution-specific updates.

Workarounds

• Manually inspect all URLs for percent-encoded characters before using with wcurl
• Use the -o flag to explicitly specify output file paths rather than relying on URL-derived filenames
• Implement wrapper scripts that validate and sanitize URLs before passing them to wcurl
• Consider using alternative download tools with proper path traversal protections until wcurl is updated

# Safe download practice: explicitly specify output path
wcurl -o ./safe_download_directory/filename.ext "https://example.com/file"

# Validate URLs before use - check for encoded traversal sequences
echo "$URL" | grep -qE '%2[Ff]|%2[Ee]|%5[Cc]' && echo "Warning: URL contains suspicious encoded characters"