CVE-2025-11563

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

• CWE-22

• https://curl.se/docs/CVE-2025-11563.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2025-11563.jsonVendor Advisory
• http://www.openwall.com/lists/oss-security/2025/11/04/1Mailing List, Third Party Advisory
• https://lists.debian.org/debian-release/2025/11/msg00504.htmlMailing List, Patch, Third Party Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11556A flaw has been found in code-projects Simple Leave Manager …9.8
• CVE-2025-11557A vulnerability has been found in projectworlds Gate Pass Ma…9.8
• CVE-2025-11558A vulnerability was found in code-projects E-Commerce Websit…9.8
• CVE-2025-1156A vulnerability has been found in Pix Software Vivaz 6.0.10 …7.3
• CVE-2025-11560The Team Members Showcase WordPress plugin before 3.5.0 does…7.1
• CVE-2025-11561A flaw was found in the integration of Active Directory and …8.8
• CVE-2025-11564The Tutor LMS – eLearning and online course solution plugin …5.3
• CVE-2025-11565CWE-22: Improper Limitation of a Pathname to a Restricted Di…7.3
• CVE-2025-11566CWE-307: Improper Restriction of Excessive Authentication At…6.9
• CVE-2025-11567CWE-276: Incorrect Default Permissions vulnerability exists …7.3
• CVE-2025-11568A data corruption vulnerability has been identified in the l…4.4
• CVE-2025-11569Rejected reason: This record was withdrawn by its CNA; furth…