{
  "cveId": "CVE-2026-15146",
  "url": "https://patchblox.com/security/cve/CVE-2026-15146",
  "summary": "CVE-2026-15146 is fixed in 5 products on 1 platform, first by wget 1.25.0-2ubuntu4.3, released July 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "wget: GNU Wget versions \u0026lt; 1.25.0\u002B4f85853f64 do not validate the IP address provided by an FTP PASV response while operat...",
  "description": "GNU Wget versions \u0026lt; 1.25.0\u002B4f85853f64 do not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget\u2019s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.",
  "published": "2026-07-10T12:17:00Z",
  "severity": "Medium",
  "cvss": 5.9,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss": 0.00166,
  "epssPercentile": 0.05933,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "wget",
      "release": "Debian 14",
      "fixedVersion": "1.25.0-3",
      "fix": "DEBIAN-CVE-2026-15146",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-15146",
      "released": "2026-07-31T14:18:19Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.19.4-1ubuntu2.2\u002Besm4",
      "fix": "wget 1.19.4-1ubuntu2.2\u002Besm4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-wget-1.19.4-1ubuntu2.2-esm4",
      "released": "2026-07-23T13:24:24Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.20.3-1ubuntu2.1\u002Besm3",
      "fix": "wget 1.20.3-1ubuntu2.1\u002Besm3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-wget-1.20.3-1ubuntu2.1-esm3",
      "released": "2026-07-23T13:24:26Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.21.2-2ubuntu1.4",
      "fix": "wget 1.21.2-2ubuntu1.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-wget-1.21.2-2ubuntu1.4",
      "released": "2026-07-23T13:24:29Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.21.4-1ubuntu4.4",
      "fix": "wget 1.21.4-1ubuntu4.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-wget-1.21.4-1ubuntu4.4",
      "released": "2026-07-23T13:24:32Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "Ubuntu 26.04.1 LTS (resolute)",
      "fixedVersion": "1.25.0-2ubuntu4.3",
      "fix": "wget 1.25.0-2ubuntu4.3",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-resolute-wget-1.25.0-2ubuntu4.3",
      "released": "2026-07-10T12:17:00Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.25.0-160000.3.1",
      "fix": "OPENSUSE-SU-2026:21665-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21665-1",
      "released": "2026-08-27T06:38:03Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "sles 15.7",
      "fixedVersion": "1.24.5-150700.3.3.1",
      "fix": "SUSE-SU-2026:3148-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3148-1",
      "released": "2026-07-21T12:44:59Z"
    },
    {
      "platform": "linux",
      "product": "wget",
      "release": "sles 16.0",
      "fixedVersion": "1.25.0-160000.3.1",
      "fix": "SUSE-SU-2026:23326-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23326-1",
      "released": "2026-08-27T06:38:45Z"
    },
    {
      "platform": "linux",
      "product": "wget1",
      "release": "Fedora 43",
      "fixedVersion": "1.25.0-3.fc43",
      "fix": "FEDORA-2026-7BBB52B49D",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-7bbb52b49d",
      "released": "2026-07-16T08:34:51Z"
    },
    {
      "platform": "linux",
      "product": "wget1-debuginfo",
      "release": "Fedora 43",
      "fixedVersion": "1.25.0-3.fc43",
      "fix": "FEDORA-2026-7BBB52B49D",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-7bbb52b49d",
      "released": "2026-07-16T08:34:51Z"
    },
    {
      "platform": "linux",
      "product": "wget1-debugsource",
      "release": "Fedora 43",
      "fixedVersion": "1.25.0-3.fc43",
      "fix": "FEDORA-2026-7BBB52B49D",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-7bbb52b49d",
      "released": "2026-07-16T08:34:51Z"
    },
    {
      "platform": "linux",
      "product": "wget1-wget",
      "release": "Fedora 43",
      "fixedVersion": "1.25.0-3.fc43",
      "fix": "FEDORA-2026-7BBB52B49D",
      "url": "https://patchblox.com/security/fix/linux/fedora-2026-7bbb52b49d",
      "released": "2026-07-16T08:34:51Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}