CVE-2014-4877
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows...
CVE-2014-4877 is a high vulnerability (CVSS 9.3) in Gnu Wget, published October 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 39.9%, the 98th percentile. Fixed in wget 1.16-1.
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Exploit likelihood
What each source reports
NVD Score used
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
CVE-2014-4877- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
CVE-2014-4877- Updated
- 2026-11-02
EUVDEUVD-2014-4796 No score
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
EUVD-2014-4796- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p2w7-gcfj-5p55 No score
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows...
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
GHSA-p2w7-gcfj-5p55- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
CVE-2014-4877- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-4877 No score
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
DEBIAN-CVE-2014-4877- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0431 No score
Updated wget packages fix CVE-2014-4877
Updated wget package fixes security vulnerability:
Wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP (CVE-2014-4877).
The default settings in wget have been changed such that wget no longer creates local symbolic links, but rather traverses them and retrieves the pointed-to file in such a retrieval. The old behaviour can be attained by passing the --retr-symlinks=no option to the wget command.
- Record
MGASA-2014-0431- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10263-1 No score
wget-1.18-2.3 on GA media
These are all security issues fixed in the wget-1.18-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10263-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-4877 No score
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
- Record
UBUNTU-CVE-2014-4877- Updated
- 2026-11-02
OSVUSN-2393-1 No score
wget vulnerability
HD Moore discovered that Wget contained a path traversal vulnerability when downloading symlinks using FTP. A malicious remote FTP server or a man in the middle could use this issue to cause Wget to overwrite arbitrary files, possibly leading to arbitrary code execution.
- Record
USN-2393-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wgetDebian:12 |
before 1.16-1 | 1.16-1 |
wgetDebian:13 |
before 1.16-1 | 1.16-1 |
wgetDebian:14 |
before 1.16-1 | 1.16-1 |
wgetDebian:6.0 |
before 1.12-2.1+deb6u1, plus listed versions 1.12-2.1 |
1.12-2.1+deb6u1 |
wgetDebian:7 |
before 1.13.4-3+deb7u2, plus listed versions 1.13.4-31.13.4-3+deb7u1 |
1.13.4-3+deb7u2 |
wgetMageia:3 |
before 1.14-2.2.mga3 | 1.14-2.2.mga3 |
wgetMageia:4 |
before 1.14-4.2.mga4 | 1.14-4.2.mga4 |
wgetRed Hat:enterprise_linux:6::client |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wget-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wgetRed Hat:enterprise_linux:6::computenode |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wget-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wgetRed Hat:enterprise_linux:6::server |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wget-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wgetRed Hat:enterprise_linux:6::workstation |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wget-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.12-5.el6_6.1 | 0:1.12-5.el6_6.1 |
wgetRed Hat:enterprise_linux:7::client |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wget-debuginfoRed Hat:enterprise_linux:7::client |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wgetRed Hat:enterprise_linux:7::computenode |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wget-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wgetRed Hat:enterprise_linux:7::server |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wget-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wgetRed Hat:enterprise_linux:7::workstation |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wget-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.14-10.el7_0.1 | 0:1.14-10.el7_0.1 |
wgetRed Hat:rhel_eus:6.5::computenode |
before 0:1.12-1.12.el6_5 | 0:1.12-1.12.el6_5 |
wget-debuginfoRed Hat:rhel_eus:6.5::computenode |
before 0:1.12-1.12.el6_5 | 0:1.12-1.12.el6_5 |
wgetRed Hat:rhel_eus:6.5::server |
before 0:1.12-1.12.el6_5 | 0:1.12-1.12.el6_5 |
wget-debuginfoRed Hat:rhel_eus:6.5::server |
before 0:1.12-1.12.el6_5 | 0:1.12-1.12.el6_5 |
wgetUbuntu:14.04:LTS |
before 1.15-1ubuntu1.14.04.1, plus listed versions 1.14-2ubuntu11.14-5ubuntu11.15-1ubuntu1 |
1.15-1ubuntu1.14.04.1 |
wgetopenSUSE:Tumbleweed |
before 1.18-2.3 | 1.18-2.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | GNU Wget FTP Symlink Arbitrary Filesystem Access | 2014-10-27 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, Metasploit, NVD, OSV |
References
git.savannah.gnu.org/cgit/wget.git/commit?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0
security.gentoo.org/glsa/glsa-201411-05.xml
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html
ubuntu.com/usn/USN-2393-1
mandriva.com/security/advisories?name=MDVSA-2015:121
Show 34 moreShow less
rhn.redhat.com/errata/RHSA-2014-1955.html
debian.org/security/2014/dsa-3062
kb.cert.org/vuls/id/685996
lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html
bugzilla.redhat.com/show_bug.cgi?id=1139181
community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access
oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
securityfocus.com/bid/70751
kc.mcafee.com/corporate/index?page=content&id=SB10106
advisories.mageia.org/MGASA-2014-0431.html
github.com/rapid7/metasploit-framework/pull/4088
nvd.nist.gov/vuln/detail/CVE-2014-4877
security-tracker.debian.org/tracker/CVE-2014-4877
bugs.mageia.org/show_bug.cgi?id=14386
access.redhat.com/errata/RHSA-2014:1764
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1764.json
cve.org/CVERecord?id=CVE-2014-4877
ubuntu.com/security/CVE-2014-4877
suse.com/security/cve/CVE-2010-2252