CVE-2026-94574: GNU Wget vulnerability
A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed?
The issue applies to Windows builds of GNU Wget obtained from eternallybored.org. The vulnerable behavior depends on the hardcoded C:\msys64 configuration path being writable by unprivileged users.
What does an attacker need to exploit this?
An attacker needs local access as an unprivileged user and the ability to write to the hardcoded C:\msys64 path. They can use the use_askpass directive in configuration to cause arbitrary code execution in another user's Wget context.
Is this a cross-user or privilege-escalation risk?
Yes. The vulnerability enables local cross-user code execution and may allow local privilege escalation when a more privileged user runs the affected Wget build after an unprivileged user has modified the writable configuration location.