# CVE-2026-94574: GNU wget local code execution via hardcoded config path

Source: https://junglewise.ai/threats/cve-2026-94574-a-local-cross-user-code-execution-vulnerability-exists-in-gnu  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94574 · Severity: high · CVSS 7.8 · Published 2026-09-22

GNU wget's Windows builds from eternallybored.org load system configuration files from a hardcoded path in C:\msys64 that is writable by unprivileged users. An attacker with local access can create a malicious configuration directory and execute arbitrary code through the use_askpass directive, potentially escalating privileges to other users on the same system.

Technologies: [Gnu Wget](https://junglewise.ai/threats/technologies/wget). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2026-94574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94574 being exploited in the wild.

**How severe is CVE-2026-94574?** High severity, with a CVSS score of 7.8, published 22 September 2026.

**Which products and versions are affected?** Gnu Wget 1.21.4 and possibly earlier Windows builds from eternallybored.org.

**Is there a fix for CVE-2026-94574?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-94574 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-94574?** Check whether you run Gnu Wget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from wget hardcoding a system-wide configuration file path (C:\msys64\qemu\opt\misc\etc\wgetrc) that can be created by any unprivileged user on Windows, exploiting the world-writable root directory permissions. An attacker can plant a malicious wgetrc with the use_askpass directive to execute arbitrary commands when wget is invoked by another user. This is a local cross-user privilege escalation vector affecting Windows-specific builds.

## Affected products

- GNU wget 1.21.4 and possibly earlier Windows builds from eternallybored.org

## Timeline

- 2026-09-22: disclosed

## References

- [https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing](https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing)
- [https://eternallybored.org/misc/wget/](https://eternallybored.org/misc/wget/)

## Related threats

- [GNU wget denial of service in FTP OPIE/S-KEY authentication](https://junglewise.ai/threats/cve-2026-16599-gnu-wget-denial-of-service-in-ftp-opie-s-key-authentication)
- [GNU Wget SSRF via unvalidated FTP PASV IP address](https://junglewise.ai/threats/cve-2026-15146-gnu-wget-ssrf-via-unvalidated-ftp-pasv-ip-address)
- [GNU Wget integer overflow in parse_content_range](https://junglewise.ai/threats/cve-2026-58470-gnu-wget-integer-overflow-in-parse-content-range)
- [GNU Wget heap buffer underread in clean_metalink_string](https://junglewise.ai/threats/cve-2026-58469-gnu-wget-heap-buffer-underread-in-clean-metalink-string)