CVE-2026-15146
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.
No public exploitation has been reported so far. A fixed version is available (see the table below).
Recommended action: Update to the fixed version listed for your distribution using the native package manager.
Severity metrics
CVSS 3.1 : 5.9 MEDIUM
Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected & fixed versions by distribution
Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.
| Distribution | Package | Affected | Fixed version | Status |
|---|---|---|---|---|
| Debian:11 | wget | - | - | affected (no fix yet) |
| Debian:12 | wget | - | - | affected (no fix yet) |
| Debian:13 | wget | - | - | affected (no fix yet) |
| Debian:14 | wget | - | - | affected (no fix yet) |
| Ubuntu:Pro:14.04:LTS | wget | - | 1.15-1ubuntu1.14.04.5+esm3 | fixed |
| Ubuntu:Pro:16.04:LTS | wget | - | 1.17.1-1ubuntu1.5+esm4 | fixed |
| Ubuntu:Pro:18.04:LTS | wget | - | 1.19.4-1ubuntu2.2+esm4 | fixed |
| Ubuntu:Pro:20.04:LTS | wget | - | 1.20.3-1ubuntu2.1+esm3 | fixed |
| Ubuntu:22.04:LTS | wget | - | 1.21.2-2ubuntu1.4 | fixed |
| Ubuntu:24.04:LTS | wget | - | 1.21.4-1ubuntu4.4 | fixed |
| Ubuntu:26.04:LTS | wget | - | 1.25.0-2ubuntu4.3 | fixed |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | wget | - | 1.24.5-150700.3.3.1 | fixed |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | wget | - | 1.14-21.28.1 | fixed |
| SUSE:Linux Enterprise Micro 5.5 | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | wget | - | 1.20.3-150000.3.34.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | wget | - | 1.20.3-150000.3.34.1 | fixed |
| openSUSE:Tumbleweed | wget | - | 1.25.0-4.1 | fixed |