CVE-2026-118485
Description
A flaw was found in axel. A remote attacker can cause the application to write downloaded content to arbitrary file system locations by enticing a user to download a file from a specially crafted URL. Because the application processes URL-encoded directory traversal sequences (such as "../") after parsing the URL path, malicious path components bypass initial validation before the output file is created. This vulnerability can lead to unauthorized file overwrites or data tampering within directories accessible to the user.
Statement
Red Hat has rated this vulnerability as having an Important severity because it enables arbitrary file overwrite with the permissions of the invoking user, potentially compromising system integrity or critical configurations. Although exploitation requires user interaction to target a malicious URL, successful exploitation allows remote attackers to place arbitrary files outside the intended download directory without authentication. In typical Red Hat environments, axel is a command-line download utility that is not invoked as a background service or with elevated privileges by default, which bounds the blast radius to the user's execution context.
Mitigation
Explicitly define the destination filename when invoking axel or restrict the process execution environment.
1. Specify a local target file using the `-o` option to prevent axel from deriving the filename from the URL path:
axel -o /path/to/downloaded_file "https://example.com/untrusted/url"
2. Alternatively, run the utility from an isolated temporary directory or within an unprivileged sandbox container where write access to sensitive files is restricted.
Caveats:
Passing a directory path rather than an explicit file name to the `-o` option still causes axel to infer the filename from the URL, which does not mitigate the vulnerability. Ensure an explicit file name is always designated.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to decode the complete URL path and extract only the final basename component prior to opening destination files in axel: upgrade to Axel 2.17.16 (or the fixed Axel builds), which decode the full URL path before isolating the final basename component using conn_output_filename, closing URL-encoded directory traversal sequences in URL path. Until patched, this is a concern on Any environment where axel downloads files from untrusted URLs without an explicit target filename specified via -o, so Always specify an explicit destination file name using the -o option, or execute axel inside an isolated temporary directory or unprivileged sandbox container. As a compensating measure, Validate the derived filename against an allowlist of permissible characters, rejecting directory separators and traversal patterns, Use an EDR agent to detect behavioral anomalies when a client utility writes or overwrites sensitive files outside standard download directories, Use Falco / eBPF runtime security to detect anomalous writes to critical filesystem locations initiated by the axel user process, and Use AIDE / File Integrity Monitoring to detect unauthorized modifications or overwrites of monitored baseline system files resulting from path traversal. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
