Skip to content
OpenAdvisories
Medium ALAS2-2025-3088 1 CVE

Moderate: curl security update (Amazon Linux 2)

Published Dec 8, 2025 · Updated Dec 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-11563: wcurl path traversal with percent-encoded slashes URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 curl 0:8.3.0-1.amzn2.0.11
Amazon Linux · 2 curl-debuginfo 0:8.3.0-1.amzn2.0.11
Amazon Linux · 2 libcurl 0:8.3.0-1.amzn2.0.11
Amazon Linux · 2 libcurl-devel 0:8.3.0-1.amzn2.0.11

Vulnerabilities 1

  • Medium 4.6
    CVE-2025-11563

    wcurl path traversal with percent-encoded slashes

    URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

    curl curl curl curl Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-11563.html