p PatchFirst

CVE-2026-15146

CVE-2026-15146

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.

CVSS 5.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • wget

    Versions
    • ≥ 0, < 1.25.0+4f85853f64: Affected (custom)

    Update to 1.25.0+4f85853f64

  • wget Debian:12

    Versions
    • 1.21.3-1
    • 1.21.3-1+deb12u1
    • 1.21.4-1
    • 1.24.5-1
    • 1.24.5-2
    • 1.25.0-1
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:13

    Versions
    • 1.25.0-2
    • 1.25.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wget Debian:14

    Versions
    • 1.25.0-2
    Affected ranges
    • ECOSYSTEM: < 1.25.0-3

    Update to 1.25.0-3

  • wget Ubuntu:Pro:14.04:LTS

    Versions
    • 1.14-2ubuntu1
    • 1.14-5ubuntu1
    • 1.15-1ubuntu1
    • 1.15-1ubuntu1.14.04.1
    • 1.15-1ubuntu1.14.04.2
    • 1.15-1ubuntu1.14.04.3
    • 1.15-1ubuntu1.14.04.4
    • 1.15-1ubuntu1.14.04.5
    • 1.15-1ubuntu1.14.04.5+esm2
    Affected ranges
    • ECOSYSTEM: < 1.15-1ubuntu1.14.04.5+esm3

    Update to 1.15-1ubuntu1.14.04.5+esm3

  • wget Ubuntu:Pro:16.04:LTS

    Versions
    • 1.16.1-1ubuntu1
    • 1.17.1-1ubuntu1
    • 1.17.1-1ubuntu1.1
    • 1.17.1-1ubuntu1.2
    • 1.17.1-1ubuntu1.3
    • 1.17.1-1ubuntu1.4
    • 1.17.1-1ubuntu1.5
    • 1.17.1-1ubuntu1.5+esm1
    • 1.17.1-1ubuntu1.5+esm3
    Affected ranges
    • ECOSYSTEM: < 1.17.1-1ubuntu1.5+esm4

    Update to 1.17.1-1ubuntu1.5+esm4

  • wget Ubuntu:Pro:18.04:LTS

    Versions
    • 1.19.1-3ubuntu1
    • 1.19.1-3ubuntu1.1
    • 1.19.2-1ubuntu1
    • 1.19.3-2ubuntu1
    • 1.19.4-1ubuntu2
    • 1.19.4-1ubuntu2.1
    • 1.19.4-1ubuntu2.2
    • 1.19.4-1ubuntu2.2+esm1
    • 1.19.4-1ubuntu2.2+esm3
    Affected ranges
    • ECOSYSTEM: < 1.19.4-1ubuntu2.2+esm4

    Update to 1.19.4-1ubuntu2.2+esm4

  • wget Ubuntu:Pro:20.04:LTS

    Versions
    • 1.20.3-1ubuntu1
    • 1.20.3-1ubuntu2
    • 1.20.3-1ubuntu2.1
    • 1.20.3-1ubuntu2.1+esm2
    Affected ranges
    • ECOSYSTEM: < 1.20.3-1ubuntu2.1+esm3

    Update to 1.20.3-1ubuntu2.1+esm3

  • wget Ubuntu:22.04:LTS

    Versions
    • 1.21-1ubuntu3
    • 1.21-1ubuntu4
    • 1.21-1ubuntu5
    • 1.21.2-2ubuntu1
    • 1.21.2-2ubuntu1.1
    • 1.21.2-2ubuntu1.3
    Affected ranges
    • ECOSYSTEM: < 1.21.2-2ubuntu1.4

    Update to 1.21.2-2ubuntu1.4

  • wget Ubuntu:24.04:LTS

    Versions
    • 1.21.3-1ubuntu1
    • 1.21.4-1ubuntu1
    • 1.21.4-1ubuntu2
    • 1.21.4-1ubuntu3
    • 1.21.4-1ubuntu4
    • 1.21.4-1ubuntu4.1
    • 1.21.4-1ubuntu4.3
    Affected ranges
    • ECOSYSTEM: < 1.21.4-1ubuntu4.4

    Update to 1.21.4-1ubuntu4.4

  • wget Ubuntu:26.04:LTS

    Versions
    • 1.25.0-2ubuntu3
    • 1.25.0-2ubuntu4
    • 1.25.0-2ubuntu4.2
    Affected ranges
    • ECOSYSTEM: < 1.25.0-2ubuntu4.3

    Update to 1.25.0-2ubuntu4.3

Original sources

Check your server →