Detections
Analytics

Echo: wget: security update to 1.25.0-2+e2

medium Tenable Self-Hosted Container Security Plugin ID 464773

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive
 mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to
 redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge
 server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or
 internal network resources. (CVE-2026-15146)

Solution

Update the wget library and its related packages to version 1.25.0-2+e2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-15146

Plugin Details

Severity: Medium

ID: 464773

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.8

Percentile: 22.47

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-15146

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2026

Vulnerability Publication Date: 7/10/2026

Reference Information

CVE: CVE-2026-15146