Axel Download Accelerator EUVD-2026-112024

Exploitation requires that a user invoke axel against an attacker-supplied or attacker-influenced URL (CVSS UI:A - active interaction), where the URL path contains percent-encoded traversal such as %2e%2e%2f; no non-default configuration or feature toggle is needed, as this is the default output-filename handling in Axel 2.17.14 and earlier. Written paths are resolved relative to axel's current working directory, so the attack escapes upward via ../ rather than writing to absolute paths, and impact is bounded by the filesystem privileges of the user running axel. Limiting factors: the victim must actually launch the download (reducing fully unattended exploitation), confidentiality is not affected (write-only primitive), and reach depends on what is writable relative to the invoking CWD.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, VC:N/VI:H/VA:H) scores 7.0 (High): the flaw is reachable over the network with low complexity and no privileges, but it requires active user interaction (UI:A) - the victim must actually invoke axel against an attacker-influenced URL. Impact is integrity/availability only (arbitrary file write that can overwrite data) with no confidentiality exposure (VC:N), which matches the source diff showing output-filename handling. No EPSS probability and no KEV status were provided in the input, so widespread or automated exploitation cannot be asserted either way; absence of those feeds is a data gap, not evidence of low risk. The vendor priority label is 'this_week', consistent with a patchable High-severity flaw rather than act_now/emergency. No standalone weaponized exploit is referenced; however, the vendor fix PR includes a regression test that publicly demonstrates the %2e%2e%2f traversal mechanism, so the technique is not secret. Net: real and worth patching this week, but the user-interaction requirement and write-relative-to-CWD scope keep it below the tier of remotely-wormable server bugs.

An attacker hosts or advertises a download link such as http://attacker/%2e%2e%2f%2e%2e%2f.bashrc; the percent-encoded sequences survive axel's URL parser because they contain no literal slashes, then http_decode() turns them into ../ before the output file is opened. When a victim runs axel on that URL, downloaded content is written to a traversed path relative to the current working directory, overwriting files with the victim's privileges. No weaponized exploit is referenced, but the vendor's fix PR ships a regression test that demonstrates the exact decode-to-traversal behavior.