CVE-2025-69195
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
Summary
Wget2: gnu wget2: memory corruption and crash via filename sanitization logic with attacker-controlled urls
Original description
The description as published by the source.
A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted URL, which, upon user interaction with wget2, can lead to memory corruption. This can cause the application to crash and potentially allow for further malicious activities.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-69195 wget2 Fixed in: 2.2.0+ds-1+deb13u1
- Ubuntu UBUNTU-CVE-2025-69195 wget2
References
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- package gitlab.com
- report bugzilla.redhat.com