{"id":"CVE-2025-69194","aliases":["AZL-73901","DEBIAN-CVE-2025-69194","EUVD-2026-1781","GHSA-82jv-f4jx-8r27","MGASA-2026-0002","UBUNTU-CVE-2025-69194","openSUSE-SU-2026:10015-1","openSUSE-SU-2026:20038-1"],"status":"published","title":"Wget2: arbitrary file write via metalink path traversal in gnu wget2","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00789,"percentile":0.56548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2026-01-07T00:00:00Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"secdongle/POC_CVE-2025-69194","title":"secdongle/POC_CVE-2025-69194","date":"2026-01-07","url":"https://github.com/secdongle/POC_CVE-2025-69194"}],"fixes":[{"ecosystem":"Azure Linux:3","package":"wget","fixed_in":["2.1.0-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget2","fixed_in":["2.2.0+ds-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget2","fixed_in":["2.2.0+ds-3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"wget2","fixed_in":["2.0.1-1.1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2.2","2.1.0-1","2.1.0-2","2.1.0-2.1","2.1.0-2.1~exp1","2.1.0-3","2.1.0-4","2.1.0-5","2.2.0+ds-1","2.2.0+ds-1~exp1","2.2.0+ds-1~exp2","2.2.0+ds-1~exp3","2.2.0+ds-2","2.2.0+ds-3"]},{"source":"osv","ecosystem":"Debian:13","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+ds-1+deb13u1"}]}],"versions":["2.2.0+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+ds-3"}]}],"versions":["2.2.0+ds-1","2.2.0+ds-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20170806-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2","1.99.1-2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2.2","2.1.0-2","2.1.0-2.1build1","2.1.0-2.1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+ds-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+ds-1","2.2.0+ds-2","2.2.0+ds-3","2.2.0+ds-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"wget2"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-69194","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2425773","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69194","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-82jv-f4jx-8r27"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69194.json","tags":["advisory"]},{"url":"https://gitlab.com/gnuwget/wget2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-69194","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0002.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34947","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/07/1","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-69194","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69194","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69195","tags":["web"]},{"url":"https://bugzilla.suse.com/1255728","tags":["report"]},{"url":"https://bugzilla.suse.com/1255729","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-69194","title":"Wget2: arbitrary file write via metalink path traversal in gnu wget2","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T07:53:48.144Z","modified":"2026-02-26T15:04:53.176Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2026-1781","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T07:53:48Z","modified":"2026-02-26T15:04:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:26.495238Z"}],"ghsa":[{"id":"GHSA-82jv-f4jx-8r27","title":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application...","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T09:31:20Z","modified":"2026-01-09T09:31:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:05:33.510969Z"}],"nvd":[{"id":"CVE-2025-69194","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T08:15:57.98Z","modified":"2026-06-17T10:00:15.757Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-69194","title":"Wget2: arbitrary file write via metalink path traversal in gnu wget2","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T07:53:48.144Z","modified":"2026-10-28T02:30:29.956192175Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-69194","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T08:15:57.98Z","modified":"2026-09-01T20:05:58.256855007Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-69194","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T08:15:00Z","modified":"2026-10-17T12:58:39.203320201Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-73901","title":"CVE-2025-69194 affecting package wget for versions less than 2.1.0-7","description":"A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink \u003cfile name\u003e elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.","status":"published","published":"2026-01-09T08:15:57Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"MGASA-2026-0002","title":"Updated wget2 packages fix security vulnerability","description":"Arbitrary File Write via Metalink Path Traversal in GNU Wget2.\n(CVE-2025-69194)\n","status":"published","published":"2026-01-10T05:07:52Z","modified":"2026-04-16T04:43:36.407061559Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10015-1","title":"libwget4-2.2.1-1.1 on GA media","description":"These are all security issues fixed in the libwget4-2.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-07T00:00:00Z","modified":"2026-03-23T04:54:21.009049Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20038-1","title":"Security update for wget2","description":"This update for wget2 fixes the following issues:\n\nChanges in wget2:\n\n- Update to release 2.2.1\n  * Fix file overwrite issue with metalink [CVE-2025-69194 bsc#1255728]\n  * Fix remote buffer overflow in get_local_filename_real()\n    [CVE-2025-69195 bsc#1255729]\n  * Fix a redirect/mirror regression from 400713ca\n  * Use the local system timestamp when requested via\n    --no-use-server-timestamps\n  * Prevent file truncation with --no-clobber\n  * Improve messages about why URLs are not being followed\n  * Fix metalink with -O/--output-document\n  * Fix sorting of metalink mirrors by priority\n  * Add --show-progress to improve backwards compatibility to wget\n  * Fix buffer overflow in wget_iri_clone() after\n    wget_iri_set_scheme()\n  * Allow 'no_' prefix in config options\n  * Use libnghttp2 for HTTP/2 testing\n  * Set exit status to 8 on 403 response code\n  * Fix convert-links\n  * Fix --server-response for HTTP/1.1\n\n- Update to release 2.2.0\n  * Don't truncate file when -c and -O are combined\n  * Don't log URI userinfo to logs\n  * Fix downloading multiple files via HTTP/2\n  * Support connecting with HTTP/1.0 proxies\n  * Ignore 1xx HTTP responses for HTTP/1.1\n  * Disable TCP Fast Open by default\n  * Fix segfault when OCSP response is missing\n  * Add libproxy support\n","status":"published","published":"2026-01-14T13:23:53Z","modified":"2026-03-23T04:54:42.501535Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}