Critical
wget2 — security advisory
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
- Products
- wget2
- Affected versions
- 0.0.20170806-1, 1.99.1-2, 1.99.1-2.1, 1.99.1-2.2, 2.1.0-2, 2.1.0-2.1build1, 2.1.0-2.1build2, 2.2.0+ds-1, 2.2.0+ds-2, 2.2.0+ds-3, 2.2.0+ds-3build1
- Fixed versions
- Not specified
- CVEs
- CVE-2025-69194
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:33 UTC · Revision 1
Source evidence
A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.
osv:UBUNTU-CVE-2025-69194
wget2
Fixed versions: Not specified
wget2
Fixed versions: Not specified
wget2
Fixed versions: Not specified
wget2
Fixed versions: Not specified
wget2
Fixed versions: Not specified
wget2
Fixed versions: Not specified
wget2
Fixed versions: Not specified
Complete source record
{
"id": "5711f8613374908de96fdcdd7e29d123d172ca5941c89be992703075ed0307d3",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2025-69194",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2025-69194",
"summary": "A security issue was discovered in GNU Wget2 when handling Metalink documents. The application fails to properly validate file paths provided in Metalink elements. An attacker can abuse this behavior to write files to unintended locations on the system. This can lead to data loss or potentially allow further compromise of the user’s environment.",
"evidence": "osv:UBUNTU-CVE-2025-69194",
"products": [
{
"name": {
"value": "wget2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.0.20170806-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "wget2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.99.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.99.1-2.1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "wget2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.99.1-2.2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "wget2",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.99.1-2.2",
"evidence": "/affected/3/versions"
},
{
"value": "2.1.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "2.1.0-2.1build1",
"evidence": "/affected/3/versions"
},
{
"value": "2.1.0-2.1build2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "wget2",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.2.0+ds-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "wget2",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.2.0+ds-3build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "wget2",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.2.0+ds-1",
"evidence": "/affected/6/versions"
},
{
"value": "2.2.0+ds-2",
"evidence": "/affected/6/versions"
},
{
"value": "2.2.0+ds-3",
"evidence": "/affected/6/versions"
},
{
"value": "2.2.0+ds-3build1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2025-69194",
"aliases": [
"UBUNTU-CVE-2025-69194"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.0.20170806-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget0",
"binary_version": "0.0.20170806-1"
},
{
"binary_name": "wget2",
"binary_version": "0.0.20170806-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.99.1-2",
"1.99.1-2.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget0",
"binary_version": "1.99.1-2.1"
},
{
"binary_name": "wget2",
"binary_version": "1.99.1-2.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.99.1-2.2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget0",
"binary_version": "1.99.1-2.2"
},
{
"binary_name": "wget2",
"binary_version": "1.99.1-2.2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.99.1-2.2",
"2.1.0-2",
"2.1.0-2.1build1",
"2.1.0-2.1build2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget2t64",
"binary_version": "2.1.0-2.1build2"
},
{
"binary_name": "wget2",
"binary_version": "2.1.0-2.1build2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"2.2.0+ds-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget3",
"binary_version": "2.2.0+ds-1"
},
{
"binary_name": "wget2",
"binary_version": "2.2.0+ds-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.2.0+ds-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget3",
"binary_version": "2.2.0+ds-3build1"
},
{
"binary_name": "wget2",
"binary_version": "2.2.0+ds-3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "wget2",
"purl": "pkg:deb/ubuntu/wget2?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.2.0+ds-1",
"2.2.0+ds-2",
"2.2.0+ds-3",
"2.2.0+ds-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-69194.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libwget3",
"binary_version": "2.2.0+ds-3build1"
},
{
"binary_name": "wget2",
"binary_version": "2.2.0+ds-3build1"
}
]
}
}
],
"modified": "2026-10-17T12:58:39.203320201Z",
"provider": "osv",
"upstream": [
"CVE-2025-69194"
],
"references": [
"https://ubuntu.com/security/CVE-2025-69194",
"https://www.cve.org/CVERecord?id=CVE-2025-69194"
]
},
"related_cves": [
{
"value": "CVE-2025-69194",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 358935,
"published_at": "2026-01-09T08:15:00+00:00"
}