← Vulnerability feed

Vulnerability record · CVE-2014-4877 · published 29 October 2014

CVE-2014-4877: Gnu wget path traversal vulnerability

Gnu · Wget

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

9.3 CVSS 2.0 High EPSS 40% · top 1.4% CWE-22 · Path traversal
9.3CVSS 2.0 base score
40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
44References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://advisories.mageia.org/MGASA-2014-0431.html
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0 Patch
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html Patch
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html
http://rhn.redhat.com/errata/RHSA-2014-1764.html
http://rhn.redhat.com/errata/RHSA-2014-1955.html
http://security.gentoo.org/glsa/glsa-201411-05.xml
http://www.debian.org/security/2014/dsa-3062
http://www.kb.cert.org/vuls/id/685996 PatchUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2015:121
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.securityfocus.com/bid/70751
http://www.ubuntu.com/usn/USN-2393-1
https://bugzilla.redhat.com/show_bug.cgi?id=1139181 Patch
https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-a Exploit
https://github.com/rapid7/metasploit-framework/pull/4088 Exploit
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
https://kc.mcafee.com/corporate/index?page=content&id=SB10106
http://advisories.mageia.org/MGASA-2014-0431.html
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0 Patch
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html Patch
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html
http://rhn.redhat.com/errata/RHSA-2014-1764.html
http://rhn.redhat.com/errata/RHSA-2014-1955.html
http://security.gentoo.org/glsa/glsa-201411-05.xml
http://www.debian.org/security/2014/dsa-3062
http://www.kb.cert.org/vuls/id/685996 PatchUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2015:121
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.securityfocus.com/bid/70751
http://www.ubuntu.com/usn/USN-2393-1
https://bugzilla.redhat.com/show_bug.cgi?id=1139181 Patch
https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-a Exploit

Track CVE-2014-4877 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-5953Gnu wget out-of-bounds write vulnerabilityBuffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspec…EPSS 5.9%9.1CVE-2024-38428Gnu wget interpretation conflict vulnerabilityurl.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data t…EPSS 0.67%8.8CVE-2017-13089GNU Wget chunked transfer parser stack buffer overflowWget before 1.19.2 fails to validate that a chunk length in a chunked HTTP response is non-negative. A negative length is passed through MIN() to fd_…EPSS 80%analysed8.8CVE-2017-13090Gnu wget heap-based buffer overflow vulnerabilityThe retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser …EPSS 37%8.8CVE-2016-4971GNU wget HTTP-to-FTP redirect arbitrary file writeGNU wget before 1.18 follows a server-supplied redirect from HTTP to a crafted FTP resource and writes the retrieved content to an attacker-chosen pa…EPSS 46%analysed8.7CVE-2026-58469Gnu wget out-of-bounds read vulnerabilityGNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/m…EPSS 0.49%8.1CVE-2016-7098Gnu wget race condition vulnerabilityRace condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass int…EPSS 7.5%7.8CVE-2018-20483Gnu wget information exposure vulnerabilityset_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attri…EPSS 0.66%

Source: NIST National Vulnerability Database (record CVE-2014-4877), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.