Patchwire CVEs, their patch status, and feeds to follow them

CVE-2025-11563

Fixed in a distro release EPSS <1%CVSS 4.6

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

Published 2026-02-25 · CVE record · OSV

Products: curl

Distro releases

ReleasePackageFixed in
Amazon Linux 2curl8.3.0-1.amzn2.0.11
Amazon Linux 2libcurl8.3.0-1.amzn2.0.11
Amazon Linux 2libcurl-devel8.3.0-1.amzn2.0.11
Amazon Linux 2023curl8.11.1-4.amzn2023.0.3
Amazon Linux 2023curl-minimal8.11.1-4.amzn2023.0.3
Amazon Linux 2023libcurl8.11.1-4.amzn2023.0.3
Amazon Linux 2023libcurl-devel8.11.1-4.amzn2023.0.3
Amazon Linux 2023libcurl-minimal8.11.1-4.amzn2023.0.3
Debian 13curl8.14.1-2+deb13u2
Debian 14curl8.17.0-2
SUSE Linux Enterprise Micro 5.2curl8.14.1-150200.4.94.1
SUSE Linux Enterprise Micro 5.3curl8.14.1-150400.5.72.1
SUSE Linux Enterprise Micro 5.4curl8.14.1-150400.5.72.1
SUSE Linux Enterprise Micro 5.5curl8.14.1-150400.5.72.1
SUSE Linux Enterprise Module for Basesystem 15 SP6curl8.14.1-150600.4.31.1
SUSE Linux Enterprise Module for Basesystem 15 SP7curl8.14.1-150700.7.5.1
SUSE Linux Enterprise Server 16.0curl8.14.1-160000.3.1
SUSE Linux Enterprise Server 16.0curl-mini8.14.1-160000.3.1
SUSE Linux Enterprise Server for SAP applications 16.0curl8.14.1-160000.3.1
SUSE Linux Enterprise Server for SAP applications 16.0curl-mini8.14.1-160000.3.1
SUSE Linux Micro 6.0curl8.14.1-2.1
SUSE Linux Micro 6.1curl8.14.1-slfo.1.1_3.1
SUSE Linux Micro 6.2curl8.14.1-160000.3.1
Ubuntu 22.04 LTScurl7.81.0-1ubuntu1.22
Ubuntu 24.04 LTScurl8.5.0-2ubuntu10.7
Ubuntu 25.10curl8.14.1-2ubuntu1.1
openSUSE Leap 15.6curl8.14.1-150600.4.31.1
openSUSE Leap 16.0curl8.14.1-160000.3.1
openSUSE Tumbleweedcurl8.17.0-1.1