CVE-2026-15146 CVE-2026-15146

Q: Is CVE-2026-15146 being exploited?

There is no known exploitation of CVE-2026-15146 in the wild and no public exploit code.

Medium 5.9 Published 10 Jul 2026 Updated 29 Oct 2026

A malicious FTP server can redirect Wget's data connection to arbitrary IPs, enabling SSRF attacks to access internal network resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-15146?

CVE-2026-15146 is a medium-severity server-side request forgery vulnerability in GNU wget Wget, published on 10 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.

Which versions are affected by CVE-2026-15146?

Linux distribution packages (1)

wget openSUSE:Tumbleweed All versions 1.25.0-4.1

How do I fix CVE-2026-15146?

Apply the vendor's patch.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-15146 being exploited?