Directory Traversal Vulnerability in Axel Download Accelerator by Axel

CVE-2026-118485

What is CVE-2026-118485?

Axel Download Accelerator, versions 2.17.14 and earlier, is vulnerable to a directory traversal issue due to improper URL percent-decoding of output filenames. This vulnerability allows attackers to embed URL-encoded sequences such as %2e%2e%2f (representing ../) into the URL path. While the URL parser processes these sequences without alteration, they are decoded into harmful directory traversal commands before the software writes the content to the filesystem. Consequently, a crafted URL could result in the application downloading files to unauthorized paths relative to the current working directory, leading to potential security breaches.

References