CVE-2026-15146: SSRF
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.
Other sources
GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wgetto a version that resolves this vulnerability.Fixed in 1.25.0-3 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.15-1ubuntu1.14.04.5+esm3 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.17.1-1ubuntu1.5+esm4 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.19.4-1ubuntu2.2+esm4 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.20.3-1ubuntu2.1+esm3 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.21.2-2ubuntu1.4 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.21.4-1ubuntu4.4 - Upgrade
Upgrade
ubuntu/wgetto a version that resolves this vulnerability.Fixed in 1.25.0-2ubuntu4.3 - Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Fixed in 1.25.0+4f85853f64
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15146?
CVE-2026-15146 has a risk score of 57, indicating a moderate level of severity.
How do I fix CVE-2026-15146?
To fix CVE-2026-15146, ensure that you update GNU Wget to the latest version where this vulnerability has been addressed.
What types of attacks can CVE-2026-15146 facilitate?
CVE-2026-15146 can facilitate attacks that redirect Wget's data connection to a malicious server, potentially leading to unauthorized data access.
In what scenarios is CVE-2026-15146 most likely to be exploited?
CVE-2026-15146 is most likely to be exploited in scenarios where Wget connects to malicious FTP servers or HTTP servers that redirect to FTP URLs.
What is the impact of CVE-2026-15146 on users of GNU Wget?
The impact of CVE-2026-15146 on users of GNU Wget includes the risk of data interception or diversion to unauthorized locations.