# GNU Wget SSRF flaw via FTP PASV

Published: 2026-07-10 · Severity: medium
Canonical: https://vorant.io/reports/b5185b93-f0c1-5dec-baf3-48b012cafc16/gnu-wget-ssrf-flaw-via-ftp-pasv

> GNU Wget 1.25.0 and earlier fails to validate FTP PASV response IPs, letting malicious FTP servers redirect Wget to internal network resources (SSRF).

GNU Wget, a widely used command-line tool for retrieving content over HTTP, HTTPS, and FTP, contains a server-side request forgery vulnerability (CVE-2026-15146) in its handling of FTP passive mode. When Wget operates in passive mode, it trusts the IP address and port returned in the server's PASV response without validation, allowing a malicious or compromised FTP server—or an HTTP server that redirects to an attacker-controlled FTP URL—to redirect Wget's data connection to arbitrary internal addresses. This is a known class of vulnerability, similar to CVE-2021-40491 previously fixed in GNU Inetutils.

The practical impact is that an attacker able to control or influence an FTP endpoint contacted by Wget can force the tool to connect to internal network services normally inaccessible from outside, potentially retrieving service banners, accessing internal HTTP endpoints, or exfiltrating reachable data. Applications and automation pipelines that embed Wget for unattended URL retrieval are especially exposed since the SSRF can be triggered via redirected or untrusted user-supplied URLs without direct operator interaction.

GNU has remediated the issue in a commit dated 07/05/2026. Users and downstream projects embedding Wget should update to the patched version per vendor guidance. No in-the-wild exploitation has been reported; this is a vendor-disclosed vulnerability with a fix already available.

## Mentioned in this report

- Vulnerabilities: CVE-2021-40491, CVE-2026-15146

## Detection guidance (public sample)

### Wget Process Initiating Connection to Internal/Private IP Address (Possible FTP PASV SSRF)

ATT&CK: T1090

Detects the wget binary establishing an outbound connection to RFC1918/loopback/link-local address ranges, which may indicate SSRF via a malicious FTP PASV response redirecting the data connection to an internal host (CVE-2026-15146). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Wget Connection to Internal IP Range Possibly via PASV SSRF
logsource:
  category: network_connection
  product: linux
selection:
  Image|endswith:
  - /wget
  - \wget.exe
condition: selection and internal_dst
fields:
- Image
- DestinationIp
- DestinationPort
- Initiated
detection_condition_note: see condition below
falsepositives:
- Internal network scanning or monitoring scripts that intentionally use wget against
  internal hosts
- Automation pipelines legitimately configured to retrieve internal resources via
  wget
level: medium
tags:
- attack.t1090
detection:
  selection:
    Image|endswith:
    - /wget
    - \wget.exe
  internal_dst:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and internal_dst
id: 56ca4701-4ee8-5e1b-bc6a-766d894b3158
status: experimental
author: Vorant
```

### Wget FTP Retrieval Followed by Unexpected Secondary Data Connection on High Port

ATT&CK: T1090

Detects a wget process that, after connecting to an FTP control port, opens a subsequent connection to a high ephemeral port on a different (non-FTP-server) internal address, consistent with an attacker-controlled PASV response redirecting the data channel for SSRF purposes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Wget Secondary Data Connection to Different Host After FTP Control Session
logsource:
  category: network_connection
  product: linux
detection:
  ftp_control:
    Image|endswith:
    - /wget
    - \wget.exe
    DestinationPort: 21
  data_conn:
    Image|endswith:
    - /wget
    - \wget.exe
    DestinationPort|gt: 1023
  internal_data_dst:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: ftp_control and data_conn and internal_data_dst
fields:
- Image
- DestinationIp
- DestinationPort
falsepositives:
- Legitimate FTP servers on internal networks that use passive mode with wget for
  routine file transfers
- NAT or load-balanced FTP infrastructure where PASV correctly returns a different
  internal front-end IP
level: medium
tags:
- attack.t1090
id: 5520f825-19b8-5d6e-9f43-1f1a974dd3a3
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Source reporting: https://kb.cert.org/vuls/id/564823

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b5185b93-f0c1-5dec-baf3-48b012cafc16/gnu-wget-ssrf-flaw-via-ftp-pasv.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup