CVE-2025-11563
📋 TL;DR
CVE-2025-11563 is a path traversal vulnerability in wcurl where URLs containing percent-encoded slashes (like %2F or %5C) can trick the tool into saving output files outside the current directory. This allows attackers to write arbitrary files to unintended locations. Only users of the wcurl command-line tool are affected.
💻 Affected Systems
- wcurl
📦 What is this software?
Wcurl by Curl
⚠️ Risk & Real-World Impact
Worst Case
An attacker could overwrite critical system files, configuration files, or create malicious executables in trusted directories, potentially leading to system compromise or data loss.
Likely Case
Attackers could write files to unexpected locations, potentially overwriting user files, creating backdoors, or planting malicious scripts that get executed later.
If Mitigated
With proper user permissions and sandboxing, impact is limited to the user's own files and directories they have write access to.
🎯 Exploit Status
Exploitation is straightforward - simply craft a URL with percent-encoded slashes. No authentication or special privileges required beyond what the wcurl user already has.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check curl.se for latest patched version
Vendor Advisory: https://curl.se/docs/CVE-2025-11563.html
Restart Required: No
Instructions:
1. Visit https://curl.se to download latest wcurl version. 2. Replace existing wcurl binary with patched version. 3. Verify installation with version check.
🔧 Temporary Workarounds
URL validation before processing
allValidate and sanitize URLs before passing to wcurl to reject those containing percent-encoded slashes
# Example bash script to check URL
url="$1"
if [[ "$url" =~ %2F|%5C ]]; then
echo "Rejecting URL with encoded slashes"
exit 1
fi
wcurl "$url"
Use alternative curl implementation
allUse standard curl instead of wcurl where possible
curl -o output.txt "URL"
🧯 If You Can't Patch
- Restrict wcurl usage to trusted users only
- Implement strict file system permissions to limit where wcurl can write files
🔍 How to Verify
Check if Vulnerable:
Test with: wcurl -o test.txt 'http://example.com/test%2F..%2Fmalicious.txt' and check if file is created outside current directoryCheck Version:
wcurl --versionVerify Fix Applied:
After patching, repeat the test above - file should be saved in current directory only📡 Detection & Monitoring
Log Indicators:
- wcurl commands with URLs containing %2F or %5C patterns
- File writes to unexpected directories by wcurl process
Network Indicators:
- Outbound requests from wcurl to URLs with encoded slashes
SIEM Query:
process.name:"wcurl" AND (cmdline:"%2F" OR cmdline:"%5C")