wget prior to 1.16 allows for a web server to write arbitrary files on the client side

Anonymous Coward
in security on (#2TS1)
Here's a concern for most of us. Be aware that the popular program wget, in versions prior to 1.16, allows for a FTP server to write arbitrary files on the client side. Wget is commonly used in shell scripts to get files or web pages from servers for further processing locally. Wget has many other uses as well, and is an important part of much command line sorcery.

A Metasploit module is available for testing:


the disclosure is here:


Redhat's bug is here:


Re: ftp web server? (Score: 1)

by evilviper@pipedot.org on 2014-10-29 19:33 (#2TSN)

If you look at the pipe history, you'll see the submission from the AC repeatedly said "web" server, and the editors simply corrected one of the two to FTP.

Changing the subject line after publication can break links, so I'd rather not, except in extreme cases.
Post Comment
The color of a red cat is?