wcurl CVE-2026-80256

Exploitation is limited to Windows systems only - the backslash character is not a path separator on Unix or macOS, making those platforms immune regardless of wcurl version. The attacker must be able to supply or influence the URL passed to wcurl: via a malicious download link, injection into a script that constructs URLs from external input, or a compromised/attacker-controlled server. The victim must invoke wcurl without explicit output filename flags (-o, -O, --output, or --no-decode-filename); use of any of these flags prevents the vulnerable decoding code path. File placement is constrained by the victim user's filesystem ACLs - the attacker cannot write to locations the running user lacks write permission for. Existing files at the target path are protected by curl's --no-clobber behavior, so the primitive creates new files rather than overwriting existing ones.

The curl project rates this Medium severity, consistent with the limited but concrete impact: an attacker can place files at unintended filesystem locations but cannot overwrite existing files and is bound by the victim's filesystem permissions. No CVSS vector was supplied in the input metadata (marked N/A), and no EPSS score is available; the assessment below is independently derived. There is no CISA KEV listing and no public exploit code identified at time of analysis. Real-world exploitability is constrained by the requirement for user interaction - the victim must invoke wcurl against an attacker-influenced URL - limiting opportunistic mass exploitation. Even a mid-sized municipal IT team in zabrze running automated wcurl-based download pipelines should treat this as a priority patch, since scripted environments that dynamically construct URLs from external input could be exploited to stage malicious content in predictable, executable locations. The Windows-only scope further bounds the blast radius relative to cross-platform vulnerabilities of similar class.

An attacker hosts a file at a URL whose path component contains a percent-encoded backslash (e.g., /downloads/app%5C..%5CStartup%5Cmalware.exe) and directs a Windows user or automated script to download it via wcurl without an explicit output flag. wcurl decodes %5C to a backslash and constructs a filesystem path that resolves outside the current working directory, depositing the file in the attacker's chosen location such as the user's Startup folder. No public proof-of-concept code is known, but the technique is straightforward given the advisory's clear description of the decode behavior.