wcurl Fixes a Windows Download-Path Bypass

The curl project published CVE-2026-80256 on September 2, 2026. The medium-severity issue affects wcurl on Windows: percent-encoded backslashes in a remote filename could be decoded and interpreted as path separators, allowing a newly downloaded file to be created outside the directory the user intended.

The condition does not overwrite an existing file when modern curl's no-clobber protection applies, and file creation remains limited by the user's filesystem permissions. Even so, teams that run Windows download jobs through proxies should upgrade and test the complete filename-to-filesystem path before resuming unattended workflows.

Scope the affected versions precisely

The advisory lists these affected ranges:

• wcurl shipped with curl 8.14.0 through 8.21.0;
• standalone wcurl 2024.12.08 through 2026.01.05.

Fixed versions are wcurl shipped with curl 8.22.0 or later, and standalone wcurl 2026.08.30 or later. The vulnerability exists only on Windows.

This is a wcurl filename-handling issue, not a general claim that every curl download, every operating system, or every proxy service is vulnerable. Inventory the actual wrapper and version invoked by the job rather than inferring exposure from a package name.

Why proxy download pipelines should care

Proxy-enabled research and collection systems often download files from many approved hosts into staging folders. They may also derive output names from response metadata or remote paths. A proxy changes the transport route but does not make a remote filename trustworthy.

A path escape can affect:

• scheduled market-research downloads;
• regional asset collection through residential exits;
• data-ingestion folders watched by another process;
• browser or shell wrappers that delegate downloads to wcurl;
• temporary directories shared by multiple workers;
• cleanup jobs that assume every output stayed under one root.

The safe boundary is the resolved filesystem destination, not the visible filename string.

Immediate response

First, pause only the affected unattended Windows jobs. Do not stop unrelated curl workloads on other systems without evidence.

Then:

1. identify every invocation of wcurl and its resolved executable path;
2. record the wcurl and bundled curl versions;
3. upgrade to curl 8.22.0 or standalone wcurl 2026.08.30 or later;
4. restart schedulers and workers so they load the corrected tool;
5. review recently written files inside the authorized job root and its permitted parent paths;
6. preserve minimal metadata for any unexpected file without opening or executing it;
7. rotate credentials only if separate evidence shows exposure.

Do not broadly delete files or wipe download directories during triage. Preserve evidence and use normal incident-response ownership.

Temporary mitigations when upgrade is delayed

The official advisory recommends explicitly selecting an output filename with the standard output options, or disabling filename percent-decoding. These controls reduce reliance on an untrusted remote filename.

Treat mitigations as temporary and verify that the wrapper actually passes them to the wcurl process. A configuration file, alias, shell function, or task runner can override the command you reviewed.

Keep no-clobber behavior enabled, but do not mistake it for complete containment. Preventing overwrite does not prove that a new file stayed inside the approved directory.

Build an isolated regression fixture

Use a controlled HTTPS endpoint and an empty temporary directory on a disposable Windows test environment. Serve harmless, uniquely marked files with a matrix of filename cases:

• a simple expected filename;
• spaces and ordinary punctuation;
• a percent-encoded backslash sequence;
• nested-looking remote names;
• repeated separators;
• a name that would collide with an existing file;
• a long but permitted filename;
• an explicitly supplied safe local output name.

Do not use executable content. A short text fixture with a random test identifier is sufficient.

For each case, record the raw remote name, decoded name, requested working directory, explicit output option, process exit code, final canonical path, whether a file was created, and its hash.

Assert containment using canonical paths

String-prefix checks are not enough. Resolve the final destination and the approved root to canonical absolute paths, then verify that the destination is a child of the approved root. The comparison should respect Windows path semantics, drive letters, separator normalization, and case behavior.

The test must fail if:

• the resolved destination is outside the approved root;
• the drive or share changes;
• a path segment is created unexpectedly;
• an existing file is replaced;
• an alternate data stream or reserved device name appears;
• the final path cannot be canonicalized;
• the wrapper reports success without a verifiable output path.

Do not open the resulting file as part of the containment assertion. Hashing and path metadata are enough for this test.

Test the real proxy route separately

Run the filename matrix first without a proxy against the controlled endpoint, then repeat through the approved proxy modes used in production. Cover HTTP proxy, HTTPS CONNECT, and any authorized regional route separately.

The expected filesystem result must be identical across routes. Route evidence should confirm the intended gateway and exit policy, but it must not be used as a substitute for destination-path validation.

Use the proxy bypass audit to verify that a failed proxy never causes direct fallback, and the proxy support escalation packet to preserve redacted evidence when behavior differs between routes.

Audit wrapper and scheduler behavior

Many incidents survive a package update because production does not invoke the binary engineers tested. Inspect:

• shell aliases, PowerShell functions, and command wrappers;
• task scheduler action paths and working directories;
• environment path order;
• configuration files that add filename options;
• service accounts and filesystem permissions;
• post-download moves, extraction, or import steps;
• retry logic that changes directories or filenames.

Log the resolved executable, version, working directory, canonical output path, case identifier, and result. Never log proxy passwords, cookies, authorization headers, or sensitive source URLs.

Verify the downstream handoff

A contained download can still become unsafe if the next process trusts filenames or extracts archives without checks. Keep the staging area non-executable, scan content according to organizational policy, validate type and size, and move files only after the path and integrity checks pass.

If an ingestion watcher observes the directory, disable it during the controlled regression. Otherwise a harmless fixture may be consumed before the test captures evidence.

Deployment checklist

• [ ] Every Windows wcurl invocation and resolved executable path is inventoried.
• [ ] Affected versions are upgraded to a fixed release.
• [ ] Schedulers and long-running workers are restarted.
• [ ] Temporary mitigations are verified at the final process boundary.
• [ ] The output directory is dedicated and minimally privileged.
• [ ] Canonical paths are checked against an approved root.
• [ ] Encoded-separator, collision, and nested-name cases pass.
• [ ] Direct and approved proxy routes produce identical contained paths.
• [ ] Proxy failure cannot trigger silent direct download.
• [ ] Logs exclude credentials and sensitive content.
• [ ] Downstream extraction and ingestion remain disabled until validation passes.

FAQ

Does this affect Linux or macOS?

The official advisory states that the bug exists only on Windows. Still inventory wrappers accurately before declaring a host unaffected.

Does no-clobber fully mitigate the issue?

No. It protects an existing target from overwrite, but the issue can create a new file outside the selected directory if permissions allow. Containment and upgrade checks are still required.

Does using a residential proxy change exposure?

No. The proxy transports the response; wcurl determines the local filename. Test proxy and direct routes to ensure wrappers behave consistently, but remediate the Windows filename handling.

Should we test with real downloaded files?

No. Use harmless controlled fixtures. Do not fetch suspicious content or probe unapproved hosts to reproduce the issue.

Source and responsible-use note

Internal research basis: curl Project Security Advisory, “wcurl backslash bypass,” CVE-2026-80256, published September 2, 2026; curl 8.22.0 release information. External research URLs are retained only in the internal operations record; this public article contains no external links.

Run tests only on systems, proxy accounts, endpoints, and file shares you own or are authorized to assess. Follow destination terms, provider limits, privacy requirements, and organizational incident-response procedures. Never execute untrusted test files or use filename handling tests to place files on third-party systems.