CVE-2026-15146

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15146", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-08T19:10:56.213Z", "datePublished": "2026-07-10T18:20:58.269Z", "dateUpdated": "2026-10-29T17:32:53.768Z"}, "containers": {"cna": {"title": "CVE-2026-15146", "descriptions": [{"lang": "en", "value": "GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget\u2019s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "GNU wget", "product": "Wget", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.0+4f85853f641863d5915786a8413e1a213726a62b", "versionType": "git"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "references": [{"url": "https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b"}, {"url": "https://kb.cert.org/vuls/id/564823"}, {"url": "https://github.com/mirror/wget/commit/4f85853f641863d5915786a8413e1a213726a62b"}], "x_generator": {"engine": "VINCE 3.0.52", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15146"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-29T17:32:53.768Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T19:17:02.863029Z", "id": "CVE-2026-15146", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T19:17:58.839Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/564823"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-10T19:30:53.123Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/564823"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-10T19:30:53.123Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15146", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T19:17:02.863029Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T19:17:54.839Z"}}], "cna": {"title": "CVE-2026-15146", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "GNU wget", "product": "Wget", "versions": [{"status": "affected", "version": "0", "lessThan": "1.25.0+4f85853f641863d5915786a8413e1a213726a62b", "versionType": "git"}]}], "references": [{"url": "https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b"}, {"url": "https://kb.cert.org/vuls/id/564823"}, {"url": "https://github.com/mirror/wget/commit/4f85853f641863d5915786a8413e1a213726a62b"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.52", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15146"}, "descriptions": [{"lang": "en", "value": "GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget\u2019s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-10-29T17:32:53.768Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15146", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:32:53.768Z", "dateReserved": "2026-07-08T19:10:56.213Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-10T18:20:58.269Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Wget", "vendor": "GNU wget", "versions": [{"lessThan": "1.25.0+4f85853f641863d5915786a8413e1a213726a62b", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cret@cert.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget\u2019s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources."}, {"lang": "es", "value": "GNU Wget no valida la direcci\u00f3n IP proporcionada por una respuesta FTP PASV mientras opera en modo pasivo FTP. Un servidor FTP malicioso, o un servidor HTTP que redirige a una URL FTP, puede explotar este comportamiento para redirigir la conexi\u00f3n de datos de Wget a una direcci\u00f3n IP y puerto arbitrarios. Esto permite a un atacante forjar solicitudes del lado del servidor (SSRF) desde la m\u00e1quina que ejecuta Wget, potencialmente accediendo a servicios de localhost o recursos de red internos."}], "id": "CVE-2026-15146", "lastModified": "2026-10-29T18:17:30.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15146", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T19:17:02.863029Z", "version": "2.0.3"}}]}, "published": "2026-07-10T19:17:20.307", "references": [{"source": "cret@cert.org", "url": "https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b"}, {"source": "cret@cert.org", "url": "https://github.com/mirror/wget/commit/4f85853f641863d5915786a8413e1a213726a62b"}, {"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/564823"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/564823"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "wget: Wget: Server-Side Request Forgery via FTP PASV response IP address validation bypass", "id": "2499143", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499143"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-918", "details": ["A flaw was found in Wget. When operating in FTP passive mode, Wget fails to validate the IP address provided in an FTP PASV response. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this vulnerability to redirect Wget's data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially leading to unauthorized access to localhost services or internal network resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-15146", "public_date": "2026-07-10T18:20:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15146\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15146\nhttps://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b\nhttps://kb.cert.org/vuls/id/564823"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.25.0 before commit 4f85853f641863d5915786a8413e1a213726a62b]"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "Wget", "source": "cna", "vendor": "GNU wget"}, "product": "wget", "vendor": "wget"}], "created": "2026-07-11T10:45:04.542563+00:00", "title": "Unchecked FTP PASV IP Validation Enables Arbitrary SSRF in GNU Wget", "updated": "2026-10-29T23:15:05.150466+00:00", "vendors": ["wget", "wget$PRODUCT$wget"]}