CVE-2026-94574

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

CVE-2014-4877 in GNU Wget before version 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, leading to arbitrary code execution. This issue occurs in a LIST response that references the same filename in two entries, one of which indicates that the filename is for a symlink.

Vulnerability in GNU Wget up to version 1.24.5. The url.c function mishandles semicolons in the userinfo component of a URI, potentially leading to misinterpretation of data as part of the host.

GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server or an HTTP server redirecting to an FTP URL can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port.

GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the html_quote_string() function in src/convert.c. A remote attacker can exploit a crafted HTML attribute with a large number of characters requiring entity encoding, causing a signed integer overflow, undersized heap allocation, and subsequent heap buffer overflow.

GNU Wget through version 1.25.0 contains a heap buffer overflow vulnerability in the convert_fname() function within src/url.c. The flaw occurs during character set conversion of a server-supplied filename when the reallocation logic miscalculates remaining space, leading to memory corruption.

In GNU Wget through version 1.25.0, an integer overflow vulnerability exists in the parse_content_range() function within src/http.c. Attackers can supply malicious Content-Range header values, causing signed integer arithmetic overflow, leading to undefined behavior and download desynchronization.

GNU Wget through version 1.25.0 contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document with a whitespace-only URL, causing a pointer to decrement past the buffer start.