CVEvulnerability

CVE-2014-4877

9.3 HIGH Published 2014-10-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-10-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-22

Description

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

Affected configurations

• gnu wget (<= 1.15) • gnu wget 1.12 • gnu wget 1.13 • gnu wget 1.13.1 • gnu wget 1.13.2 • gnu wget 1.13.3 • gnu wget 1.13.4 • gnu wget 1.14

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References