GNU Wget CVE-2026-15146

Exploitation requires that the victim machine is running GNU Wget version 1.25.0 or earlier and is fetching content either directly from an attacker-controlled FTP server in passive mode (the Wget default), or following an HTTP 301/302 redirect from any HTTP/HTTPS URL to an attacker-controlled ftp:// URL. No authentication or privileges on the victim machine are required. Exploitation is constrained by the following factors: (1) passive FTP mode must be active (default in most Wget builds, but can be disabled with --no-passive-ftp); (2) the attacker must control or compromise the FTP server - or an HTTP server in the redirect chain - that Wget connects to; (3) the Wget host must have network-level access to the internal IP/port embedded in the PASV response for the SSRF to reach a useful target; (4) SSVC classifies the attack as not automatable at scale, limiting mass-exploitation potential. The SSRF impact is bounded by the internal network reachability of the host running Wget.

The NVD-supplied CVSS base vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 5.9) contains a critical inconsistency: AV:L (Local attack vector) requires the attacker to have local access to the vulnerable system, yet the vulnerability description unambiguously describes an attack originating from a remote FTP server that the Wget client connects to over the network. The attack does not require local access to the victim machine. This suggests the NVD CVSS vector may be in error; a correct assessment likely places AV:N, which raises the practical severity above 5.9. SSVC signals corroborate measured concern: exploitation status is 'none,' the attack is not automatable at mass scale, and technical impact is only partial - suggesting opportunistic exploitation is not currently occurring. EPSS data is absent from available intelligence, preventing probability-of-exploitation comparison. No CISA KEV entry exists. Real-world risk is highest in environments where Wget fetches content from untrusted FTP servers in automated pipelines (CI/CD, cron-based download scripts, container build processes), especially on hosts with access to cloud metadata endpoints (169.254.169.254) or privileged internal services.

An attacker sets up a malicious FTP server (or configures a web server to return a 302 redirect to ftp://attacker-server/) that a CI/CD pipeline or cron job uses Wget to fetch from. When Wget enters passive mode, the attacker's server returns a crafted PASV 227 response specifying 169.254.169.254:80 (the AWS/GCP/Azure Instance Metadata Service) as the data connection endpoint. Wget opens a TCP connection to the metadata service and the attacker receives the response content, potentially extracting cloud credentials or IAM role tokens. No public POC exploit has been identified at time of analysis.