Wget2 Metalink Path Traversal: Downloading Your Way to RCE

Amit Schendel

Senior Security Researcher

Jan 16, 2026·5 min read·0 visits

PoC Available

Executive Summary (TL;DR)

Wget2 trusted Metalink filenames implicitly. If you download a malicious '.metalink' file with version <= 2.2.0, it can traverse directories (e.g., '../../') and overwrite sensitive files like SSH keys or shell configs. Fixed in version 2.2.1.

GNU Wget2 contains a critical path traversal vulnerability within its Metalink parsing logic. By constructing a malicious Metalink XML file, an attacker can trick the client into writing files anywhere on the filesystem, leading to potential RCE.

Attack Flow Diagram

Official Patches

GitLab (GNU Wget2)Official fix commit

Red HatRed Hat Bugzilla Report

Fix Analysis (1)

Technical Appendix

CVSS Score

8.8/ 10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

4.00%

Top 99% most exploited

Affected Systems

GNU Wget2 <= 2.2.0

Affected Versions Detail

Product	Affected Versions	Fixed Version
GNU Wget2 GNU	<= 2.2.0	2.2.1

Attribute	Detail
CWE ID	CWE-22 (Path Traversal)
CVSS v3.1	8.8 (High)
Attack Vector	Network / User Interaction
Impact	Arbitrary File Write / RCE
Commit	684be478
Status	Patched (v2.2.1)