CVE-2026-94574 in Wget
Summary
by MITRE • 09/22/2026
A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in specific Windows builds of GNU wget distributed by eternallybored.org stems from a critical misconfiguration regarding file system permissions and hardcoded path assumptions. The core technical flaw lies in the software's reliance on a static configuration directory located at C:\msys64, which is intended to store user-specific settings or environment variables required for proper operation. However, this specific directory path possesses overly permissive access control lists that allow unprivileged users to write arbitrary files into it. This design oversight creates a classic insecure default configuration scenario where the application trusts data from a location that lacks integrity guarantees, effectively allowing any local process running under a standard user account to manipulate the execution context of wget without requiring elevated privileges initially.
The operational impact is realized through the use_askpass directive within the wget configuration files. When this directive is enabled or triggered during specific operations involving authentication prompts, wget reads its configuration from the aforementioned C:\msys64 directory. Because unprivileged users can write to this location, an attacker with local access can craft a malicious configuration file containing arbitrary commands or scripts designed for execution by the system shell. By placing this payload in the writable path and triggering the use_askpass functionality, the attacker forces wget to execute their code within the context of the user running the application. While the initial execution occurs at the user's privilege level, the ability to inject code into a trusted utility often serves as a stepping stone for further exploitation, such as manipulating environment variables or leveraging other local vulnerabilities to achieve higher levels of access.
This vulnerability is categorized under CWE-284 Improper Access Control and CWE-732 Incorrect Permission Assignment for Critical Resource, reflecting the failure to restrict write permissions on a configuration directory that influences application behavior. From an offensive security perspective, this aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically where attackers use system utilities like wget as part of their execution chain. The scenario also touches upon lateral movement or privilege escalation vectors if the executed code interacts with other local services or exploits additional weaknesses in the operating system's security model to gain administrative rights.
Mitigation strategies must focus on correcting the file system permissions and altering default configuration paths. Administrators should immediately audit the C:\msys64 directory and any similar hardcoded paths used by wget installations, ensuring that write access is restricted exclusively to administrators or specific service accounts rather than all users. Additionally, it is advisable to update to a patched version of GNU wget if one has been released by the distributor, as this may involve relocating configuration files to user-specific directories such as %APPDATA% which typically have stricter default permissions on modern Windows systems. Users should also avoid enabling the use_askpass directive unless absolutely necessary and ensure that no untrusted scripts or binaries reside in any directory referenced by wget's configuration loading process. Regular auditing of executable paths and strict adherence to the principle of least privilege are essential practices to prevent similar local code execution vulnerabilities from being exploited for unauthorized access or system compromise.