Every CVE Search/ Get API key

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request...

8.8 HighPublic exploitFix available

CVE-2016-4971 is a high vulnerability (CVSS 8.8) in Gnu Wget, published June 10, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.1%, the 98th percentile. Fixed in wget 1.17.1-r1.

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

46.1%Down 2.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
CVE-2016-4971
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
CVE-2016-4971
Updated
2026-11-02
EUVDEUVD-2016-5944 No score

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
EUVD-2016-5944
Updated
2026-11-03
GitHub AdvisoriesGHSA-5w8p-rj9f-xvj7 8.8

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request...

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
GHSA-5w8p-rj9f-xvj7
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2016-4971 8.8

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
ALPINE-CVE-2016-4971
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
CVE-2016-4971
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2016-4971 8.8

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
DEBIAN-CVE-2016-4971
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2016:2587 7.0

Red Hat Security Advisory: wget security and bug fix update

Record
RHSA-2016:2587
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-4971 8.8

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

Record
UBUNTU-CVE-2016-4971
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0323 No score

Updated wget packages fix security vulnerability

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource (CVE-2016-4971).

Fixed a potential race condition by creating files with .tmp ext and making them accessible to the current user only (CVE-2016-7098).

Record
MGASA-2016-0323
Updated
2026-11-02
OSVopenSUSE-SU-2024:10263-1 No score

wget-1.18-2.3 on GA media

These are all security issues fixed in the wget-1.18-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10263-1
Updated
2026-11-02
OSVSUSE-SU-2016:2226-1 No score

Security update for wget

This update for wget fixes the following issues:

  • Fix for HTTP to a FTP redirection file name confusion vulnerability (bsc#984060, CVE-2016-4971).
  • Work around a libidn vulnerability (bsc#937096, CVE-2015-2059).
  • Fix for wget fails with basicauth: Failed writing HTTP request: Bad file descriptor (bsc#958342)
Record
SUSE-SU-2016:2226-1
Updated
2026-11-02
OSVSUSE-SU-2016:2358-1 No score

Security update for wget

This update for wget fixes the following issues:

  • CVE-2016-4971: A HTTP to FTP redirection file name confusion vulnerability was fixed. (bsc#984060).

  • CVE-2016-7098: A potential race condition was fixed by creating files with .tmp ext and making them accessible to the current user only. (bsc#995964)

Bug fixed:

  • Wget failed with basicauth: Failed writing HTTP request: Bad file descriptor (bsc#958342)
Record
SUSE-SU-2016:2358-1
Updated
2026-11-02
OSVUSN-3012-1 No score

wget vulnerability

Dawid Golunski discovered that Wget incorrectly handled filenames when being redirected from an HTTP to an FTP URL. A malicious server could possibly use this issue to overwrite local files.

Record
USN-3012-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wget
Alpine:v3.4
 before 1.17.1-r1
1.17.1-r1
wget
Debian:12
 before 1.18-1
1.18-1
wget
Debian:13
 before 1.18-1
1.18-1
wget
Debian:14
 before 1.18-1
1.18-1
wget
Debian:7
 before 1.13.4-3+deb7u3, plus listed versions
1.13.4-31.13.4-3+deb7u11.13.4-3+deb7u2
1.13.4-3+deb7u3
wget
Mageia:5
 before 1.15-5.1.mga5
1.15-5.1.mga5
wget
Red Hat:enterprise_linux:7::client
 before 0:1.14-13.el7
0:1.14-13.el7
wget-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.14-13.el7
0:1.14-13.el7
wget
Red Hat:enterprise_linux:7::computenode
 before 0:1.14-13.el7
0:1.14-13.el7
wget-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.14-13.el7
0:1.14-13.el7
Show 21 moreShow less
Affected packages
PackageAffectedFixed
wget
Red Hat:enterprise_linux:7::server
 before 0:1.14-13.el7
0:1.14-13.el7
wget-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.14-13.el7
0:1.14-13.el7
wget
Red Hat:enterprise_linux:7::workstation
 before 0:1.14-13.el7
0:1.14-13.el7
wget-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.14-13.el7
0:1.14-13.el7
wget
SUSE:Linux Enterprise Desktop 12 SP1
 before 1.14-10.3
1.14-10.3
wget
SUSE:Linux Enterprise Server 12 SP1
 before 1.14-10.3
1.14-10.3
wget
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 1.14-10.3
1.14-10.3
wget-openssl1
SUSE:Linux Enterprise Server 11-SECURITY
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:OpenStack Cloud 5
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Manager 2.1
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Manager Proxy 2.1
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Linux Enterprise Server 11 SP3-LTSS
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget-openssl1
SUSE:Linux Enterprise Server 11 SP3-LTSS
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget-openssl1
SUSE:Linux Enterprise Server 11 SP3-TERADATA
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Linux Enterprise Server 11 SP4
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 1.11.4-1.32.1
1.11.4-1.32.1
wget
Ubuntu:14.04:LTS
 before 1.15-1ubuntu1.14.04.2, plus listed versions
1.14-2ubuntu11.14-5ubuntu11.15-1ubuntu11.15-1ubuntu1.14.04.1
1.15-1ubuntu1.14.04.2
wget
Ubuntu:16.04:LTS
 before 1.17.1-1ubuntu1.1, plus listed versions
1.16.1-1ubuntu11.17.1-1ubuntu1
1.17.1-1ubuntu1.1
wget
openSUSE:Tumbleweed
 before 1.18-2.3
1.18-2.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBGNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution2016-07-06
Exploit-DBGNU Wget < 1.18 - Arbitrary File Upload (2)2021-04-30
PoC in GitHubdinidhu96/IT19013756_-CVE-2016-4971-2020-05-12
PoC in GitHubgitcollect/CVE-2016-49712016-07-02
PoC in GitHubmbadanoiu/CVE-2016-49712019-01-05

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open