Severity by source
Attacker supplies a malicious URL over the network (AV:N), user must invoke wcurl against it (UI:R), resulting only in unintended file placement with no confidentiality or availability impact (I:L).
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Path traversal in wcurl for Windows allows a crafted URL containing percent-encoded backslashes to redirect a downloaded file to an attacker-controlled directory outside the user's intended destination. Affecting wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05, the flaw exploits Windows path-separator semantics: wcurl decodes %5C to a backslash, which Windows treats as a directory separator, causing file placement at an unintended filesystem path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation is limited to Windows systems only - the backslash character is not a path separator on Unix or macOS, making those platforms immune regardless of wcurl version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The curl project rates this Medium severity, consistent with the limited but concrete impact: an attacker can place files at unintended filesystem locations but cannot overwrite existing files and is bound by the victim's filesystem permissions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to curl 8.22.0 (released September 2, 2026), which ships the fixed wcurl; alternatively upgrade standalone wcurl to version 2026.08.30 (released August 30, 2026). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows systems, servers, containers, and CI/CD agents running curl versions 8.14.0 through 8.21.0 or standalone wcurl versions 2024.12.08 through 2026.01.05, including development workstations and automated build pipelines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today