CVE-2026-15146

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

CVE-2014-4877 in GNU Wget before version 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, leading to arbitrary code execution. This issue occurs in a LIST response that references the same filename in two entries, one of which indicates that the filename is for a symlink.

Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.

A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c. A remote attacker can exploit a crafted HTML attribute with a large number of characters requiring entity encoding, causing a signed integer overflow, undersized heap allocation, and subsequent heap buffer overflow.

GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c. The flaw occurs during character set conversion of a server-supplied filename when the reallocation logic miscalculates remaining space, leading to memory corruption.

In GNU Wget through version 1.25.0, an integer overflow vulnerability exists in the parse_content_range() function within src/http.c. Attackers can supply malicious Content-Range header values, causing signed integer arithmetic overflow, leading to undefined behavior and download desynchronization.

GNU Wget through version 1.25.0 contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document with a whitespace-only URL, causing a pointer to decrement past the buffer start.

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.