CVE-2026-80256
Published:September 02, 2026
Updated:September 02, 2026
wcurl backslash bypass: a flaw in how wcurl handles backslashes makes it possible to create a new attacker-controlled file outside the directory chosen by the user, because percent-encoded backslashes are decoded in the output file name. Windows only. Affects wcurl shipped with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05; fixed in curl 8.22.0 and wcurl 2026.08.30.
Affected Packages
libcurl (CONAN):
Affected version(s) >=8.15.0 <8.22.0Fix Suggestion:
Update to version 8.22.0https://github.com/curl/wcurl.git (GITHUB):
Affected version(s) >=v2024.12.08 <v2026.08.30Fix Suggestion:
Update to version v2026.08.30https://github.com/curl/curl.git (GITHUB):
Affected version(s) >=curl-8_14_0 <curl-8_22_0Fix Suggestion:
Update to version curl-8_22_0Related Resources (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
ACTIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
Path Traversal: '.../...//'