Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN757
_____________________________________________________________________

DATE                : 04/11/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running wcurl versions prior to 
                      2025.11.04 (shipped with curl 8.17.0).

=====================================================================
https://curl.se/docs/CVE-2025-11563.html
_____________________________________________________________________

CVE-2025-11563
wcurl path traversal with percent-encoded slashes

Project curl Security Advisory, November 4 2025 - Permalink

VULNERABILITY

URLs containing percent-encoded slashes (/ or \) can trick wcurl into
saving the output file outside of the current directory without the
user explicitly asking for it.


INFO

wcurl will not overwrite any files if the curl version is >= 7.83.

The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CVE-2025-11563 to this issue.

CWE-35: Path Traversal

Severity: Moderate


AFFECTED VERSIONS

    Affected versions: wcurl shipped with curl 8.14.0 to and including 8.16.0
    Affected versions: wcurl 2024.12.08 to and including 2025.09.27
    Not affected versions: wcurl shipped with curl < 8.14.0 and >= 8.17.0
    Not affected versions: wcurl < 2024.12.08 and >= 2025.11.04
    Introduced-in: https://github.com/curl/wcurl/commit/e01d578582a23695ee3cec08
    Introduced-in: https://github.com/curl/curl/commit/23bed347b3892277938259

This flaw only affects the wcurl command line tool.


SOLUTION

Starting in wcurl 2025.11.04 (shipped with curl 8.17.0), this mistake
is fixed.

    Fixed-in: https://github.com/curl/wcurl/commit/524f7e733237cd26553dfd
    Fixed-in: https://github.com/curl/curl/commit/fb0c014e30e5f4de7aa0d566c


RECOMMENDATIONS

A - Upgrade wcurl to the one shipped in curl version 8.17.0, wcurl to
version 2025.11.04

B - Apply the patch to your local wcurl version

C - Explicitly choose an output filename with -o/-O/--output

D - Disable percent-decoding for output filenames with --no-decode-filename


TIMELINE

This issue was reported to the curl project on October 6, 2025. We
contacted distros@openwall on October 30.

wcurl 2025.11.04 was released on November 4 2025, coordinated with the
publication of this advisory.

curl 8.17.0 was released on November 5 2025.

The curl security team is not aware of any active exploits using this
vulnerability.


CREDITS

    Reported-by: Stanislav Fort (Aisle Research)
    Patched-by: Samuel Henrique
    Patched-by: Sergio Durigan Junior

Thanks a lot!

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================