Description
wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wget | 1.9.1-11 | — |
| Debian 13 | wget | 1.9.1-11 | — |
| Debian 12 | wget | 1.9.1-11 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | wget | 1.10.1-2.4E.1 | RHSA-2005:771 |
| RHEL 3 | wget | 1.10.1-1.30E.1 | RHSA-2005:771 |
Advisories 1
- RHSA-2005:771 Red Hat Security Advisory: wget security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2005:771 vendor-advisory
- 11871 vdb-entry
- 20041209 wget: Arbitrary file overwriting/appending/creating and other vulnerabilities mailing-list
- USN-145-1 vendor-advisory
- wget-file-overwrite(18420) vdb-entry
- oval:org.mitre.oval:def:11682 vdb-entry signature
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=261755
- 1012472 vdb-entry