GNU Wget versions older than 1.25.0+4f85853f64 do not validate the IP address supplied in an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server‑side requests from the machine running Wget, potentially accessing localhost services or internal network resources. The weakness is reflected by CWE‑918, representing a lack of input validation for remote connection targets.

The vulnerability affects GNU Wget versions older than 1.25.0+4f85853f64 that support FTP passive mode. The affected builds do not validate the IP address from an FTP PASV response. Any unpatched installation that can process such responses is at risk.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description: an attacker who can control an FTP server or an HTTP redirect to an FTP URL can manipulate the passive FTP response, directing the vulnerable client to forge a connection to an arbitrary IP address and port, potentially accessing localhost services or internal network resources.