CVE-2025-11563: Curl Wcurl Path Traversal Vulnerability

CVE-2025-11563 Overview

CVE-2025-11563 is a path traversal vulnerability [CWE-22] in the wcurl command line tool, a wrapper around curl maintained by the curl project. URLs that contain percent-encoded slash characters (%2F for / or %5C for \) can trick wcurl into writing the downloaded output file outside of the current working directory. The user does not need to specify an alternate output path for the write to occur outside the intended location. The flaw only affects the wcurl command line tool and does not impact the underlying curl binary or libcurl.

Critical Impact
An attacker who controls or supplies a crafted URL can cause wcurl to save downloaded content to an arbitrary filesystem location relative to the invocation directory, enabling file overwrite or placement in sensitive paths.

Affected Products

curlwcurl command line tool
Distributions packaging wcurl (including Debian, per the Debian release discussion)
Environments where users invoke wcurl with attacker-influenced URLs

Discovery Timeline

2026-02-25 - CVE-2025-11563 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11563

Vulnerability Analysis

wcurl derives the output filename from the URL supplied on the command line. When a URL contains percent-encoded slash characters, wcurl decodes them before determining the output path. The decoded slashes are then interpreted by the filesystem as directory separators. As a result, the tool writes the downloaded content to a path that traverses out of the current working directory. The user receives no prompt or warning that the output location differs from the expected default.

Because exploitation requires the victim to run wcurl with a crafted URL, user interaction is part of the attack chain. The impact is limited to file writes with the privileges of the invoking user, and the vulnerability does not grant remote code execution on its own. However, writing predictable filenames such as shell profile scripts, cron entries, or configuration files can lead to subsequent code execution when those files are later processed.

Root Cause

The root cause is missing sanitization of percent-encoded path separators when wcurl constructs the local output filename from the URL. The tool does not reject decoded / or \ characters in the derived filename, nor does it constrain the write target to the current directory. This is a classic path traversal weakness tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation begins when a victim runs wcurl against a URL supplied by an attacker, for example a link shared in chat, embedded in documentation, or returned from a compromised web service. The URL contains percent-encoded slashes in the path component, such as https://example.com/foo%2F..%2F..%2Fetc%2Fpasswd.bak. When wcurl processes the URL, the decoded filename resolves outside the current directory. The download is written to the traversed path with the privileges of the user running the command.

Described in prose only; no verified public proof-of-concept code is available. Refer to the curl Security Advisory CVE-2025-11563 for authoritative technical detail.

Detection Methods for CVE-2025-11563

Indicators of Compromise

Files written outside the working directory that coincide with wcurl invocations in shell history or process logs.
Presence of URLs containing %2F or %5C sequences in the path segment passed as an argument to wcurl.
Unexpected modifications to user configuration files such as ~/.bashrc, ~/.ssh/authorized_keys, or files under ~/.config/ that correlate with wcurl execution.

Detection Strategies

Audit shell history and command execution telemetry for wcurl invocations that include percent-encoded path separators in the URL argument.
Monitor process creation events for wcurl child processes on developer workstations, CI/CD runners, and build servers where downloads from external URLs are common.
Compare the working directory of the wcurl process against the resolved output file path recorded in filesystem telemetry.

Monitoring Recommendations

Enable filesystem auditing for writes to sensitive user configuration paths originating from wcurl or its parent shell process.
Ingest package manager events to identify hosts running unpatched wcurl versions and prioritize them for upgrade.
Alert on command line arguments to wcurl that contain %2F, %2f, %5C, or %5c substrings in the URL path.

How to Mitigate CVE-2025-11563

Immediate Actions Required

Upgrade wcurl to the fixed version published by the curl project as soon as the update reaches your distribution.
Inventory systems that ship wcurl, including developer laptops, containers, and CI/CD images, and prioritize patching.
Instruct users to avoid running wcurl against untrusted URLs until the patched version is deployed.

Patch Information

The curl project has published a fix and vendor guidance in the curl Security Advisory CVE-2025-11563 and machine-readable data at curl CVE-2025-11563 Data. Debian packaging coordination is tracked in the Debian Release Discussion. Additional community context is available in the Openwall OSS Security Notice.

Workarounds

Use curl directly with an explicit -o output filename instead of wcurl when handling URLs from untrusted sources.
Run wcurl from a dedicated, disposable working directory with no sensitive files above it in the filesystem hierarchy.
Pre-validate URLs for percent-encoded path separators (%2F, %5C) before passing them to wcurl in scripts or automation.

bash

# Configuration example: reject URLs containing encoded path separators before invoking wcurl
url="$1"
if printf '%s' "$url" | grep -qiE '%2f|%5c'; then
  echo "Refusing URL with encoded path separator: $url" >&2
  exit 1
fi
wcurl "$url"