CVE-2004-1487

wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a...

5.0 MediumFix available

CVE-2004-1487 is a medium vulnerability (CVSS 5.0) in Gnu Wget, published February 15, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in wget 1.9.1-11.

wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a redirection URL containing a ".." that resolves to the IP address of the malicious server, which bypasses wget's filtering for ".." sequences.

Exploit likelihood

1.66%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2004-1487
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-1487
Updated: 2026-11-02

EUVDEUVD-2004-1481 No score

Record: EUVD-2004-1481
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wh4v-xm5m-9jfg No score

wget 1.8.x and 1.9.x allows a remote malicious web server to overwrite certain files via a...

Record: GHSA-wh4v-xm5m-9jfg
Updated: 2026-11-02

OSV No score

Record: CVE-2004-1487
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-1487 No score

Record: DEBIAN-CVE-2004-1487
Updated: 2026-11-02

Affected products

gnu wget

Affected packages

Affected packages
Package	Affected	Fixed
`wget` Debian:12	before 1.9.1-11	1.9.1-11
`wget` Debian:13	before 1.9.1-11	1.9.1-11
`wget` Debian:14	before 1.9.1-11	1.9.1-11
`wget` Red Hat:enterprise_linux:3::as	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::as	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::desktop	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::es	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget-debuginfo` Red Hat:enterprise_linux:3::es	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:3::ws	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`wget-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:1.10.1-1.30E.1	0:1.10.1-1.30E.1
`wget` Red Hat:enterprise_linux:4::as	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::as	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::desktop	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::es	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::es	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget` Red Hat:enterprise_linux:4::ws	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1
`wget-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:1.10.1-2.4E.1	0:1.10.1-2.4E.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 22 moreShow less