Is CVE-2026-15146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15146 being exploited in the wild.

How severe is CVE-2026-15146?

Informational severity, published 10 July 2026.

Is there a fix for CVE-2026-15146?

A patch was published on 2026-07-05: Fix committed to upstream master Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15146 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15146?

Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15146: GNU Wget SSRF via unvalidated FTP PASV IP address

CVE-2026-15146 · Severity: info · Published 2026-07-10

GNU Wget is a widely used command-line tool for downloading files from the internet. A security flaw in how it handles FTP connections allows a malicious server to trick Wget into connecting to different, potentially private internal systems instead of the intended file location. This could allow an attacker to scan internal networks, access private services, or steal data from systems that are not normally exposed to the internet.

Technologies: Gnu Wget. Vendors: Gnu.

Quick answers

Is CVE-2026-15146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15146 being exploited in the wild.
How severe is CVE-2026-15146?: Informational severity, published 10 July 2026.
Which products and versions are affected?: Gnu Wget 1.25.0 and earlier.
Is there a fix for CVE-2026-15146?: A patch was published on 2026-07-05: Fix committed to upstream master Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15146 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15146?: Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in GNU Wget versions 1.25.0 and earlier due to improper validation of FTP PASV and LPSV responses. When operating in FTP passive mode, Wget accepts the IP address and port provided by the server for the data connection without verifying if the IP matches the control connection's peer address. An attacker-controlled FTP server, or an HTTP server that redirects Wget to a malicious FTP URL, can exploit this to force Wget to establish a connection to internal network resources or localhost services. The issue was addressed by ensuring Wget rejects PASV/LPSV responses if the advertised address does not match the control connection's peer address.

Affected products

GNU Wget 1.25.0 and earlier

Timeline

2026-05-27: disclosed: Vendor notified
2026-07-05: patched: Fix committed to upstream master
2026-07-10: advisory: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.