Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-10T18:20:58 wget: Wget: Server-Side Request Forgery via FTP PASV response IP address validation bypass 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CWE-918

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.

A flaw was found in Wget. When operating in FTP passive mode, Wget fails to validate the IP address provided in an FTP PASV response. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this vulnerability to redirect Wget's data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially leading to unauthorized access to localhost services or internal network resources.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Fix deferred wget Red Hat Enterprise Linux 6 Out of support scope wget Red Hat Enterprise Linux 7 Out of support scope wget Red Hat Enterprise Linux 8 Fix deferred wget Red Hat Enterprise Linux 9 Fix deferred wget https://www.cve.org/CVERecord?id=CVE-2026-15146 https://nvd.nist.gov/vuln/detail/CVE-2026-15146 https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b https://kb.cert.org/vuls/id/564823