SB2026090232 - Path traversal in wcurl and cURL

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2026-80256)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to create a new file outside the intended directory.

The vulnerability exists due to path traversal in wcurl output filename handling when decoding percent-encoded backslashes on Windows. A remote attacker can provide a crafted filename to create a new file outside the intended directory.

The new file is subject to the user's filesystem permissions, the target file must not already exist, and this issue affects only Windows.

Remediation

Install update from vendor's website.

References

• https://curl.se/docs/CVE-2026-80256.html
• https://github.com/curl/wcurl/commit/511ce2e6dc0fcae6714746ea1798b391