Description
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.
Published: 2014-10-29
Score: 9.3 Critical
EPSS: 74.3% High
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-82-1 wget security update
Debian DSA Debian DSA DSA-3062-1 wget security update
Ubuntu USN Ubuntu USN USN-2393-1 Wget vulnerability
References
Link Providers
http://advisories.mageia.org/MGASA-2014-0431.html cve-icon cve-icon
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=18b0979357ed7dc4e11d4f2b1d7e0f5932d82aa7 cve-icon cve-icon
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=b4440d96cf8173d68ecaa07c36b8f4316ee794d0 cve-icon cve-icon
http://lists.gnu.org/archive/html/bug-wget/2014-10/msg00150.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00004.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00009.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-11/msg00026.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-1764.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-1955.html cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-201411-05.xml cve-icon cve-icon
http://www.debian.org/security/2014/dsa-3062 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/685996 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2015:121 cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html cve-icon cve-icon
http://www.securityfocus.com/bid/70751 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2393-1 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=1139181 cve-icon cve-icon
https://community.rapid7.com/community/metasploit/blog/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access cve-icon cve-icon
https://github.com/rapid7/metasploit-framework/pull/4088 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 cve-icon cve-icon
https://kc.mcafee.com/corporate/index?page=content&id=SB10106 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2014-4877 cve-icon
https://www.cve.org/CVERecord?id=CVE-2014-4877 cve-icon
History

Sun, 13 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.74311}

 epss

{'score': 0.69365}

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.57321}

 epss

{'score': 0.74311}

Subscriptions

Gnu Wget
Redhat Enterprise Linux Rhel Eus
cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2024-08-06T11:27:36.989Z

Reserved: 2014-07-10T00:00:00.000Z

Link: CVE-2014-4877

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2014-10-29T10:55:05.417

Modified: 2026-05-06T22:30:45.220

Link: CVE-2014-4877

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-10-27T00:00:00Z

Links: CVE-2014-4877 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses