URLs containing percent-encoded slashes (/ or \) can trick wcurl into saving the output file outside of the current directory without the user explicitly asking for it. This flaw only affects the wcurl command line tool.
8.14.1-2ubuntu1.1Exploitability
AV:NAC:LPR:LUI:RScope
S:UImpact
C:LI:LA:NCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N