CVE-2025-69194
📋 TL;DR
CVE-2025-69194 is a path traversal vulnerability in GNU Wget2's Metalink document handling that allows attackers to write files to arbitrary locations on the system. This can lead to data loss, file corruption, or potentially enable further system compromise. Users who download files via Wget2 with Metalink support enabled are affected.
💻 Affected Systems
- GNU Wget2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to privilege escalation, data destruction, or remote code execution if combined with other vulnerabilities.
Likely Case
File corruption or data loss through overwriting critical system or user files, potentially disrupting system operations.
If Mitigated
Limited impact with proper file permissions and sandboxing, though still poses data integrity risks.
🎯 Exploit Status
Exploitation requires the victim to download a malicious Metalink document. No authentication needed once the document is processed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisories for specific patched versions
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2025-69194
Restart Required: No
Instructions:
1. Check your distribution's security advisories. 2. Update Wget2 package via package manager. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable Metalink support
allDisable Metalink functionality in Wget2 configuration or compilation
Recompile Wget2 without --with-metalink option
Set metalink=off in wget2rc configuration
Restrict Wget2 usage
linuxLimit Wget2 execution to trusted users or disable where not needed
chmod 750 /usr/bin/wget2
setfacl -m u:trusteduser:rx /usr/bin/wget2
🧯 If You Can't Patch
- Implement strict file system permissions to limit write access
- Monitor Wget2 usage and log all Metalink document downloads
🔍 How to Verify
Check if Vulnerable:
Check Wget2 version and if Metalink support is enabled: wget2 --version | grep -i metalinkCheck Version:
wget2 --version | head -1Verify Fix Applied:
Verify updated version and test with known safe Metalink document📡 Detection & Monitoring
Log Indicators:
- Wget2 processes writing files outside expected directories
- Metalink document downloads with unusual file paths
Network Indicators:
- Downloads of Metalink documents from untrusted sources
SIEM Query:
process.name:"wget2" AND file.path:"*../*"