CVE-2025-69194
Wget2: arbitrary file write via metalink path traversal in gnu wget2
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wget2: arbitrary file write via metalink path traversal in gnu wget2
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
CVE-2025-69194- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-1781
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
EUVD-2026-1781- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-82jv-f4jx-8r27
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application...
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
GHSA-82jv-f4jx-8r27- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
CVE-2025-69194- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Wget2: arbitrary file write via metalink path traversal in gnu wget2
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
CVE-2025-69194- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-69194
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
DEBIAN-CVE-2025-69194- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2025-69194
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
UBUNTU-CVE-2025-69194- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-73901 No score
CVE-2025-69194 affecting package wget for versions less than 2.1.0-7
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Record
AZL-73901- Updated
- 2026-11-05
OSVMGASA-2026-0002 No score
Updated wget2 packages fix security vulnerability
Arbitrary File Write via Metalink Path Traversal in GNU Wget2. (CVE-2025-69194)
- Record
MGASA-2026-0002- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10015-1 No score
libwget4-2.2.1-1.1 on GA media
These are all security issues fixed in the libwget4-2.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10015-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20038-1 No score
Security update for wget2
This update for wget2 fixes the following issues:
Changes in wget2:
-
Update to release 2.2.1
- Fix file overwrite issue with metalink [CVE-2025-69194 bsc#1255728]
- Fix remote buffer overflow in get_local_filename_real() [CVE-2025-69195 bsc#1255729]
- Fix a redirect/mirror regression from 400713ca
- Use the local system timestamp when requested via --no-use-server-timestamps
- Prevent file truncation with --no-clobber
- Improve messages about why URLs are not being followed
- Fix metalink with -O/--output-document
- Fix sorting of metalink mirrors by priority
- Add --show-progress to improve backwards compatibility to wget
- Fix buffer overflow in wget_iri_clone() after wget_iri_set_scheme()
- Allow 'no_' prefix in config options
- Use libnghttp2 for HTTP/2 testing
- Set exit status to 8 on 403 response code
- Fix convert-links
- Fix --server-response for HTTP/1.1
-
Update to release 2.2.0
- Don't truncate file when -c and -O are combined
- Don't log URI userinfo to logs
- Fix downloading multiple files via HTTP/2
- Support connecting with HTTP/1.0 proxies
- Ignore 1xx HTTP responses for HTTP/1.1
- Disable TCP Fast Open by default
- Fix segfault when OCSP response is missing
- Add libproxy support
- Record
openSUSE-SU-2026:20038-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wgetAzure Linux:3 |
before 2.1.0-7 | 2.1.0-7 |
wget2Debian:12 |
All versions, plus listed versions 1.99.1-2.22.1.0-12.1.0-22.1.0-2.12.1.0-2.1~exp1 Show 9 moreShow less2.1.0-32.1.0-42.1.0-52.2.0+ds-12.2.0+ds-1~exp12.2.0+ds-1~exp22.2.0+ds-1~exp32.2.0+ds-22.2.0+ds-3 |
None known |
wget2Debian:13 |
before 2.2.0+ds-1+deb13u1, plus listed versions 2.2.0+ds-1 |
2.2.0+ds-1+deb13u1 |
wget2Debian:14 |
before 2.2.0+ds-3, plus listed versions 2.2.0+ds-12.2.0+ds-2 |
2.2.0+ds-3 |
wget2Mageia:9 |
before 2.0.1-1.1.mga9 | 2.0.1-1.1.mga9 |
wget2Ubuntu:18.04:LTS |
All versions, plus listed versions 0.0.20170806-1 |
None known |
wget2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.99.1-21.99.1-2.1 |
None known |
wget2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.99.1-2.2 |
None known |
wget2Ubuntu:24.04:LTS |
All versions, plus listed versions 1.99.1-2.22.1.0-22.1.0-2.1build12.1.0-2.1build2 |
None known |
wget2Ubuntu:25.10 |
All versions, plus listed versions 2.2.0+ds-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wget2Ubuntu:26.10 |
All versions, plus listed versions 2.2.0+ds-3build1 |
None known |
wget2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.2.0+ds-12.2.0+ds-22.2.0+ds-32.2.0+ds-3build1 |
None known |
wget2openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.2.1-1.1 | 2.2.1-1.1 |
wget2openSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.2.1-bp160.1.1 | 2.2.1-bp160.1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | secdongle/POC_CVE-2025-69194 | 2026-01-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69194 is a high vulnerability (CVSS 8.8) in Gnu Wget2, published January 7, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in wget 2.1.0-7.
References
access.redhat.com/security/cve/CVE-2025-69194
bugzilla.redhat.com/show_bug.cgi?id=2425773
nvd.nist.gov/vuln/detail/CVE-2025-69194
github.com/advisories/GHSA-82jv-f4jx-8r27
gitlab.com/gnuwget/wget2
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2025-69194
advisories.mageia.org/MGASA-2026-0002.html
bugs.mageia.org/show_bug.cgi?id=34947
openwall.com/lists/oss-security/2026/01/07/1
ubuntu.com/security/CVE-2025-69194
cve.org/CVERecord?id=CVE-2025-69194
suse.com/security/cve/CVE-2025-69194
bugzilla.suse.com/1255728