Critical Wget2 Flaws Expose Users to Arbitrary File Overwrites and Memory Crashes

Two newly identified vulnerabilities in GNU Wget2 could allow remote attackers to overwrite sensitive files or crash systems, simply by enticing a user to download a malicious file. Tracked as CVE-2025-69194 and CVE-2025-69195, the flaws target core file handling during Metalink processing and during sanitized filename handling, respectively.

The path traversal flaw arises when Wget2 trusts attacker-supplied <file name> values in Metalink v3/v4 documents, enabling an attacker to craft a Metalink file with traversal sequences or absolute paths to force the tool to escape the download directory and potentially overwrite files such as startup configurations like .bashrc.

The second flaw is a stack-based buffer overflow that can occur when attacker-controlled URL paths are processed with safety options enabled, writing into a fixed 1024-byte stack buffer without proper size checks. Both flaws are remotely exploitable with no authentication, requiring only that a user downloads a malicious file, and they could result in data loss, memory corruption, or execution of further exploits. Users are urged to update Wget2 promptly.