Skip to content
OpenAdvisories
Medium ALAS2023-2025-1317 1 CVE

Moderate: curl security update (Amazon Linux 2023)

Published Dec 8, 2025 · Updated Dec 8, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-11563: wcurl path traversal with percent-encoded slashes URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 curl 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 curl-debuginfo 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 curl-debugsource 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 curl-minimal 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 curl-minimal-debuginfo 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 libcurl 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 libcurl-debuginfo 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 libcurl-devel 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 libcurl-minimal 0:8.11.1-4.amzn2023.0.3
Amazon Linux · 2023 libcurl-minimal-debuginfo 0:8.11.1-4.amzn2023.0.3

Vulnerabilities 1

  • Medium 4.6
    CVE-2025-11563

    wcurl path traversal with percent-encoded slashes

    URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.

    curl curl curl curl Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-11563.html