CVE-2026-118485 in Axel
Summary
by MITRE • 10/28/2026
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability in Axel Download Accelerator versions 2.17.14 and earlier stems from an improper handling of input data during file path construction, specifically involving the sequence of operations applied to URL components before writing downloaded content to disk. When a user initiates a download via a crafted HTTP or HTTPS URL containing encoded directory traversal sequences such as percent-encoded dot-dot-slash characters, the application first parses the Uniform Resource Locator to extract the filename component from the request path. This parsing step correctly isolates the target file name without interpreting the encoded slashes as literal directory separators, thereby preserving the integrity of the initial structural analysis. However, a critical flaw exists in the subsequent processing stage where the extracted filename undergoes URL percent-decoding using functions like http_decode prior to being used for filesystem operations.
This specific ordering of operations creates a classic path traversal condition because the decoding occurs after the extraction but before the file open call. By embedding sequences such as %2e%2e%2f within the URL, an attacker ensures that these characters remain invisible to the initial parser while remaining intact in the string buffer. Once the application proceeds to write the downloaded data, it applies the decoding transformation which converts the encoded triplets into literal ../ directory traversal markers. Consequently, the resulting file path is no longer confined to the intended download destination or current working directory but instead points to arbitrary locations on the local filesystem relative to where Axel was executed. This allows for the overwriting of existing files in sensitive directories if sufficient permissions are available, potentially leading to system compromise through techniques such as replacing configuration files, scripts, or binaries with malicious content controlled by the attacker.
From a technical classification perspective, this flaw aligns directly with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-74 Insecure Deserialization if interpreted broadly in terms of untrusted data handling leading to unintended execution contexts. The attack vector is categorized under ATT&CK technique T1059 Command and Scripting Interpreter or more specifically T1612 Backup Data Manipulation depending on the target file, as it involves manipulating local files through a network-facing application feature. The operational impact ranges from minor data corruption in unprivileged scenarios to complete remote code execution if an attacker can overwrite executable binaries or system configuration files with payloads that are subsequently triggered by other processes or users.
Mitigation strategies for this vulnerability primarily involve updating Axel Download Accelerator to version 2.17.15 or later where the issue has been addressed through corrected input validation and path normalization logic. In environments where immediate patching is not feasible, administrators should enforce strict network segmentation to prevent untrusted parties from initiating downloads via Axel. Additionally, running the application with restricted user privileges limits the potential impact of file overwrites by ensuring that even if traversal succeeds, the attacker cannot write to critical system directories or overwrite sensitive configuration files located outside standard download folders. Implementing input sanitization at the proxy level before requests reach Axel can also serve as a compensating control by stripping out encoded path separators from incoming URLs.