Executive brief
GNU wget's Windows builds from eternallybored.org load system configuration files from a hardcoded path in C:\msys64 that is writable by unprivileged users. An attacker with local access can create a malicious configuration directory and execute arbitrary code through the use_askpass directive, potentially escalating privileges to other users on the same system.
Technical details
The vulnerability stems from wget hardcoding a system-wide configuration file path (C:\msys64\qemu\opt\misc\etc\wgetrc) that can be created by any unprivileged user on Windows, exploiting the world-writable root directory permissions. An attacker can plant a malicious wgetrc with the use_askpass directive to execute arbitrary commands when wget is invoked by another user. This is a local cross-user privilege escalation vector affecting Windows-specific builds.
Affected products
- GNU wget 1.21.4 and possibly earlier Windows builds from eternallybored.org
Timeline
- 2026-09-22: disclosed