CVE-2025-69194 is a high severity flaw (CVSS 8.8) in GNU Wget2. File paths in Metalink documents are not validated, so a crafted document can make Wget2 write files to unintended places. The record gives no fixed version. Check the Red Hat entry and avoid untrusted Metalink files.
What's affected
- GNU Wget2, when it handles Metalink documents.
- Fixed version: not stated in the record. See the Red Hat entry and your distribution's security tracker.
- Wget2 is a separate program from classic GNU Wget.
How to check if you're exposed
Check whether Wget2 is installed and which version:
wget2 --version
Then search scripts, CI jobs and container builds for wget2 used with Metalink input. Without Metalink, the described path is not in play. Compare your package version with the fixed one listed by your distribution.
What to do now
- Find Wget2 in build scripts, base images and developer machines.
- Install the distribution update that fixes this CVE once available, using the Red Hat entry or your vendor's tracker.
- Do not use Wget2 with Metalink files from sources you do not trust until you have updated.
- Run download jobs as an unprivileged user in a directory with limited write access.
- Prefer verified checksums and signatures for downloaded files.
Download tools show up in many places that are easy to forget: Dockerfiles, CI jobs, install scripts and developer machines. A quick search for the tool name across your repositories finds them. Replacing a download of unsigned content with one that checks a signature or checksum reduces risk well beyond this one CVE.
Why it matters
The weakness is CWE-22, path traversal. A Metalink file names the files to fetch, and Wget2 trusted the name field when choosing where to save. A name that climbs out of the target folder can place a file somewhere else.
The vector needs user interaction, so someone has to run Wget2 on the crafted document. The risk is greatest in automated jobs that fetch Metalink files from third party mirrors, because a write to a startup file or a script directory can turn data loss into code execution. The record does not list this CVE as exploited in the wild.
Path traversal in download tools is easy to underestimate. The tool is not a server, so it feels safe. The risk comes from automation that feeds it data from outside your control, such as mirror lists, package manifests and links in tickets. When that data names a file, a name that climbs out of the target directory can write over something important.
Practical defences are plain. Run downloads as a user with write access to one folder only. In containers, mount the download folder alone. Avoid root. Verify what you fetched with a checksum or signature, and skip Metalink input from sources you do not control.
Track the Red Hat entry and your own vendor's tracker, since fixed package versions differ by distribution.
Quick check
Does CVE-2025-69194 affect classic wget?
The record names GNU Wget2 only. Check your distribution for which package you have.
Sources
Last reviewed: 19 October 2026.
