Answer in brief
CVE-2026-118485 records a High severity (CVSS 7.0) vulnerability in Axel Download Accelerator Path Traversal via URL Filename Decoding. The current sources do not mark it as known exploited. The current feed maps Axel Download Accelerator/Axel (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Axel Download Accelerator/Axel (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Axel Download Accelerator/Axelgeneric | >=0 <=2.17.14 | Not reported |
Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 28, 2026
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encoded ../) sequences in the URL path. These sequences survive the URL parser intact (they contain no literal / characters) but are decoded into directory traversal sequences before the output file is opened for writing. As a result, a crafted URL can cause axel to write downloaded content to arbitrary filesystem paths relative to the current working directory.
Quoted source text, attributed separately from HOL analysis.