Skip to content

CVE-2004-2014

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the...

2.6 LowPublic exploitFix available

CVE-2004-2014 is a low vulnerability (CVSS 2.6) in Gnu Wget, published December 31, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in wget 1.9.1-12.

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Exploit likelihood

0.96%Down 2.3 points since Feb 4, 2022

What each source reports

NVD Score used 2.6

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Record: CVE-2004-2014
CVSS 2.0: 2.6 LowAV:L/AC:H/Au:N/C:N/I:P/A:P
Updated: 2026-11-02

CVE List No score

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Record: CVE-2004-2014
Updated: 2026-11-02

EUVDEUVD-2004-2006 No score

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Record: EUVD-2004-2006
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8ghf-v9f7-25jp No score

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the...

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Record: GHSA-8ghf-v9f7-25jp
Updated: 2026-11-02

OSV No score

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Record: CVE-2004-2014
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-2014 No score

Wget 1.9 and 1.9.1 allows local users to overwrite arbitrary files via a symlink attack on the name of the file being downloaded.

Record: DEBIAN-CVE-2004-2014
Updated: 2026-11-02

Affected products

gnu wget

Affected packages

Affected packages
Package	Affected	Fixed
`wget` Debian:12	before 1.9.1-12	1.9.1-12
`wget` Debian:13	before 1.9.1-12	1.9.1-12
`wget` Debian:14	before 1.9.1-12	1.9.1-12
`wget` Red Hat:enterprise_linux:3::as	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::as	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::desktop	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::es	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::es	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::ws	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`wget-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:4::as	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::as	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::desktop	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::es	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::es	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::ws	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WGet 1.x - Insecure File Creation Race Condition	2004-05-17

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 24 moreShow less