Vulnerability · Published Jan 9, 2026 · Assigned by fedora

CVE-2025-69194Wget2: arbitrary file write via metalink path traversal in gnu wget2

High 8.8

In plain English

A high-severity path traversal in wget2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 43.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink <file name> elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	wget2	no fix listed	DEBIAN-CVE-2025-69194
Debian:13	wget2	2.2.0+ds-1+deb13u1	DEBIAN-CVE-2025-69194
Debian:14	wget2	2.2.0+ds-3	DEBIAN-CVE-2025-69194
Ubuntu:22.04:LTS	wget2	no fix listed	UBUNTU-CVE-2025-69194
Ubuntu:24.04:LTS	wget2	no fix listed	UBUNTU-CVE-2025-69194
Ubuntu:25.10	wget2	no fix listed	UBUNTU-CVE-2025-69194
Ubuntu:26.04:LTS	wget2	no fix listed	UBUNTU-CVE-2025-69194
Ubuntu:26.10	wget2	no fix listed	UBUNTU-CVE-2025-69194

Affected products (as reported)

Vendor	Product	Versions
	wget2	0 – through 2.2.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2025-69194 vdb-entry, x_refsource_REDHAT
RHBZ#2425773 issue-tracking, x_refsource_REDHAT