Main Vulnerability Database Vulnerabilities #VU146678

Path traversal in cURL and wcurl - CVE-2026-80256

Published: September 2, 2026

Vulnerability identifier: #VU146678

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-80256

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to create a new file outside the intended directory.

The vulnerability exists due to path traversal in wcurl output filename handling when decoding percent-encoded backslashes on Windows. A remote attacker can provide a crafted filename to create a new file outside the intended directory.

The new file is subject to the user's filesystem permissions, the target file must not already exist, and this issue affects only Windows.

Affected software

cURL
wcurl

How to mitigate CVE-2026-80256

Install security update from vendor's website.

cURL - update to 8.22.0
wcurl - update to 2026.08.30

External References

Related Security Bulletins