GNU Wget does not validate the IP address supplied in an FTP PASV response when operating in passive mode, enabling a malicious FTP server or an HTTP redirect to an FTP URL to cause Wget to establish a data connection to an attacker‑chosen IP address and port. This results in a server‑side request forgery that can expose internal services or localhost resources to the attacker. The weakness is reflected by CWE‑918, representing a lack of input validation for remote connection targets.

The vulnerability affects GNU Wget implementations that support FTP passive mode. No specific affected version range is provided, so any unpatched build capable of processing FTP PASV responses may be impacted.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description: an attacker who can control an FTP server or an HTTP redirect to an FTP URL can manipulate the passive FTP response, directing the vulnerable client to forge a connection to an arbitrary IP address and port, potentially accessing localhost services or internal network resources.