{"id":"CVE-2025-69195","aliases":["AZL-73904","DEBIAN-CVE-2025-69195","EUVD-2026-1777","GHSA-q2gj-jpwc-8f46","UBUNTU-CVE-2025-69195","openSUSE-SU-2026:10015-1","openSUSE-SU-2026:20038-1"],"status":"published","title":"Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00348,"percentile":0.28784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-01-07T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"wget","fixed_in":["2.1.0-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget2","fixed_in":["2.2.0+ds-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget2","fixed_in":["2.2.0+ds-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+ds-1+deb13u1"}]}],"versions":["2.2.0+ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+ds-3"}]}],"versions":["2.2.0+ds-1","2.2.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20170806-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2","1.99.1-2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.1-2.2","2.1.0-2","2.1.0-2.1build1","2.1.0-2.1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+ds-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+ds-1","2.2.0+ds-2","2.2.0+ds-3","2.2.0+ds-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"wget2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"wget2"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-69195","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2425770","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69195","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q2gj-jpwc-8f46"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69195.json","tags":["advisory"]},{"url":"https://gitlab.com/gnuwget/wget2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-69195","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-69195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69195","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69195","tags":["web"]},{"url":"https://bugzilla.suse.com/1255728","tags":["report"]},{"url":"https://bugzilla.suse.com/1255729","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-69195","title":"Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T07:57:17.24Z","modified":"2026-02-26T15:04:52.822Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2026-1777","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T07:57:17Z","modified":"2026-02-26T15:04:52Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:26.495238Z"}],"ghsa":[{"id":"GHSA-q2gj-jpwc-8f46","title":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the...","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T09:31:20Z","modified":"2026-01-09T09:31:24Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:05:33.510969Z"}],"nvd":[{"id":"CVE-2025-69195","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T08:15:58.147Z","modified":"2026-06-17T10:00:15.873Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-69195","title":"Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T07:57:17.24Z","modified":"2026-10-28T02:30:29.935382863Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-69195","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T08:15:58.147Z","modified":"2026-09-01T20:05:58.203575424Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-69195","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T08:15:00Z","modified":"2026-10-17T12:58:39.601634985Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-73904","title":"CVE-2025-69195 affecting package wget for versions less than 2.1.0-7","description":"A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.","status":"published","published":"2026-01-09T08:15:58Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"openSUSE-SU-2026:10015-1","title":"libwget4-2.2.1-1.1 on GA media","description":"These are all security issues fixed in the libwget4-2.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-07T00:00:00Z","modified":"2026-03-23T04:54:21.009049Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20038-1","title":"Security update for wget2","description":"This update for wget2 fixes the following issues:\n\nChanges in wget2:\n\n- Update to release 2.2.1\n  * Fix file overwrite issue with metalink [CVE-2025-69194 bsc#1255728]\n  * Fix remote buffer overflow in get_local_filename_real()\n    [CVE-2025-69195 bsc#1255729]\n  * Fix a redirect/mirror regression from 400713ca\n  * Use the local system timestamp when requested via\n    --no-use-server-timestamps\n  * Prevent file truncation with --no-clobber\n  * Improve messages about why URLs are not being followed\n  * Fix metalink with -O/--output-document\n  * Fix sorting of metalink mirrors by priority\n  * Add --show-progress to improve backwards compatibility to wget\n  * Fix buffer overflow in wget_iri_clone() after\n    wget_iri_set_scheme()\n  * Allow 'no_' prefix in config options\n  * Use libnghttp2 for HTTP/2 testing\n  * Set exit status to 8 on 403 response code\n  * Fix convert-links\n  * Fix --server-response for HTTP/1.1\n\n- Update to release 2.2.0\n  * Don't truncate file when -c and -O are combined\n  * Don't log URI userinfo to logs\n  * Fix downloading multiple files via HTTP/2\n  * Support connecting with HTTP/1.0 proxies\n  * Ignore 1xx HTTP responses for HTTP/1.1\n  * Disable TCP Fast Open by default\n  * Fix segfault when OCSP response is missing\n  * Add libproxy support\n","status":"published","published":"2026-01-14T13:23:53Z","modified":"2026-03-23T04:54:42.501535Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}