CVE-2016-4971

What it actually does

Remote server can force wget to write attacker-controlled content to arbitrary local filesystem paths via an HTTP-to-FTP redirect that bypasses path sanitization.

Why it matters to the business

Attackers can overwrite configuration files, scripts, or binaries on systems that fetch content with wget, leading to system compromise, data corruption, or persistent unauthorized access.

How an attack unfolds

An attacker hosts a malicious HTTP server that issues a 301/302 redirect to a specially crafted FTP URL containing path traversal sequences; when wget follows the redirect it writes the supplied content to any chosen local file instead of restricting writes to the current directory.

How to fix it

Upgrade GNU wget to version 1.18 or later (fixed in commit e996e322ffd42aaa051602da182d03178d0f13e1). For odoo (Bitnami) deployments, upgrade to 15.0.0 or newer. Where immediate upgrade is impossible, avoid using wget against untrusted URLs and prefer curl with --remote-name-off or other hardened clients.

How to confirm the fix worked

Confirm wget --version reports 1.18 or higher; re-test affected redirect scenarios in an isolated environment to verify path traversal is blocked; review package manifests or dependency locks for the listed fixed versions.

Typical attack path

1. Attacker prepares HTTP server returning redirect to ftp://.../..%2F..%2Ftarget/path
2. Victim or automated process invokes wget against the attacker-controlled HTTP URL
3. wget follows redirect and performs FTP retrieval, writing received data to the traversed local path
4. Attacker-supplied file overwrites or creates a file usable for code execution or persistence

How to detect it

Search command-line logs, process execution records, and wget history files for invocations containing ftp:// URLs with encoded traversal sequences or unexpected absolute paths; correlate with subsequent file-creation events outside the working directory.

• wget.*ftp://.*%2F%2E%2E%2F
• wget.*ftp://.*\.\./
• ftp://.*@.*:21/.*\.\.

What your security team should do

• Prioritize patching all wget instances to 1.18+ within the next maintenance window
• Inventory scripts and automation that invoke wget against external or user-supplied URLs
• Add wget version checks to CI/CD and container base-image scanning
• Monitor for unusual file writes in directories commonly targeted by path traversal