CVE-2004-1488

wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses...

5.0 MediumPublic exploitFix available

CVE-2004-1488 is a medium vulnerability (CVSS 5.0) in Gnu Wget, published February 15, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.9%, the 96th percentile. Fixed in wget 1.9.1-11.

wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses to the terminal, which may allow remote malicious web servers to inject terminal escape sequences and execute arbitrary code.

Exploit likelihood

11.9%Down 12.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2004-1488
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-1488
Updated: 2026-11-02

EUVDEUVD-2004-1482 No score

Record: EUVD-2004-1482
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xrhg-fh2g-fpxj No score

wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP responses...

Record: GHSA-xrhg-fh2g-fpxj
Updated: 2026-11-02

OSV No score

Record: CVE-2004-1488
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-1488 No score

Record: DEBIAN-CVE-2004-1488
Updated: 2026-11-02

Affected products

gnu wget

Affected packages

Affected packages
Package	Affected	Fixed
`wget` Debian:12	before 1.9.1-11	1.9.1-11
`wget` Debian:13	before 1.9.1-11	1.9.1-11
`wget` Debian:14	before 1.9.1-11	1.9.1-11
`wget` Red Hat:enterprise_linux:3::as	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::as	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::desktop	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::es	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::es	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::ws	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`wget-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:4::as	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::as	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::desktop	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::es	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::es	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::ws	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	GNU Wget 1.x - Multiple Vulnerabilities	2004-12-10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 24 moreShow less