PT-2026-57263 · Gnu · Wget

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-15146

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GNU Wget versions prior to 1.25.1

Description GNU Wget fails to validate the IP address provided by an FTP PASV response when operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect the data connection to an arbitrary IP address and port. This leads to Server-Side Request Forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location, potentially allowing access to localhost services or internal network resources.

Recommendations Update GNU Wget to the latest patched version. Implement robust egress filtering and network segmentation to limit the potential impact of the issue.

Fix

Related Identifiers

CVE-2026-15146

Affected Products

Wget

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-15146 · Security Note
• https://kb.cert.org/vuls/id/564823 · Note
• https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b · Note
• https://reddit.com/r/SecOpsDaily/comments/1usx0y5/vu564823_gnu_wget_enables_ssrf_via_unvalidated · Reddit Post