Axel Download Accelerator Path Traversal via URL Filename Decoding

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.

Üreticinin çözüm notu (İngilizce)

Apply patch provided by Axel. Will be fixed in 2.17.16 as well

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/axel-download-accelerator/axel/milestone/22 Üretici bülteni
• github.com/…anges/4e76e1a1dd1c4ea11b445e2c45e4ee257c76314e Yama
• github.com/axel-download-accelerator/axel/issues/477 Üçüncü taraf
• advisories.orangecyberdefense.com/advisories/167 Üçüncü taraf

Kayıt geçmişi

1. 28 Eki 2026 14:26Yayımlandı

İlgili açıklar

• 3,4 CVE-2026-90721Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 throug…
• 7,2 CVE-2025-27920 Aktif istismarSrimax Output Messenger'da dizin geçiş (directory traversal) açığı