PT-2025-54482 · Wget2+1 · Wget2+1

Published 2025-01-01 · Updated 2026-02-28 · CVE-2025-69194

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Wget2 (affected versions not specified)

Description GNU Wget2 contains a path traversal flaw when processing Metalink documents. The application does not properly validate file paths within the <file name> elements of Metalink v3/v4 documents. This allows an attacker to craft malicious Metalink files containing traversal sequences (like ../../) or absolute paths, forcing Wget2 to write files to unintended locations. This can lead to data loss, arbitrary file overwrite, or potentially remote code execution if an attacker overwrites user configuration files. The vulnerability is remotely exploitable and requires no authentication, relying on a user downloading a malicious Metalink file. The affected component is the Metalink Handler.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-73901

BDU:2026-00913

CVE-2025-69194

MGASA-2026-0002

OPENSUSE-SU-2026:10015-1

OPENSUSE-SU-2026:20038-1

Affected Products

Debian

Wget2

References · 39

• 🔥 https://github.com/secdongle/POC_CVE-2025-69194 · Exploit
• https://cve.org/CVERecord?id=CVE-2025-69194 · Security Note
• https://osv.dev/vulnerability/AZL-73901 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20038-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-69194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69194 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0002.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10015-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69194 · Security Note
• https://osv.dev/vulnerability/MGASA-2026-0002 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-69194 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69194 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00913 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-69194 · Vendor Advisory
• https://twitter.com/transilienceai/status/2008380828657533093 · Twitter Post