Vulnerabilidades do Gnu Wget2

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Gnu Wget2: 3 registro(s), com versões afetadas e correções.
cpe:2.3:a:gnu:wget2

CVE-2026-1858 Média · 4.8 CWE-20 29/04/2026

wget2 Improper Certificate Validation

wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

CVE-2025-69195 Alta · 8.8 CWE-121 09/01/2026

Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.

CVE-2025-69194 Crítica · 9.8 CWE-22 09/01/2026

Wget2: arbitrary file write via metalink path traversal in gnu wget2

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.