Absolute Path Traversal Vulnerability in GNU Wget from GNU

CVE-2014-4877

Summary

The vulnerability in GNU Wget, prior to version 1.16, occurs when recursion is enabled, allowing remote FTP servers to exploit an absolute path traversal flaw. By sending a crafted LIST response that references the same filename within multiple entries, one of which is a symlink, attackers can manipulate files on the local system and potentially execute arbitrary code. This risk underscores the importance of updating to secure versions and configuring Wget properly.

References