---
title: Critical GNU Wget2 Vulnerability Lets Attackers Overwrite System Files
description: Serious GNU Wget2 flaw (CVE-2025-69194) lets attackers overwrite files remotely. Avoid untrusted Metalinks. Rated 8.8 CVSS.
canonical_url: https://codekeeper.co/ticker/gnu-wget2-security-flaw-cve-2025-69194
---

# Critical GNU Wget2 Vulnerability Lets Attackers Overwrite System Files

Serious GNU Wget2 flaw (CVE-2025-69194) lets attackers overwrite files remotely. Avoid untrusted Metalinks. Rated 8.8 CVSS.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jan 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A serious security flaw in GNU Wget2 (CVE-2025-69194) allows remote attackers to overwrite files anywhere on a victim's computer. The vulnerability exploits how Wget2 processes Metalink documents, which describe download locations and checksums. Attackers can create malicious Metalink files with path traversal sequences that trick Wget2 into writing files to dangerous locations. When users download these weaponized documents, the tool fails to properly validate file paths, potentially allowing attackers to overwrite system files, modify security settings, or create backdoor accounts. Red Hat rates this as "Important" severity with a CVSS score of 8.8. Currently, no complete fix exists, so users should avoid processing Metalink files from untrusted sources. **Source:** [Cybersecurity News](https://cybersecuritynews.com/gnu-wget2-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fgnu-wget2-security-flaw-cve-2025-69194%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks China-Linked Warlock Ransomware Still Breaking Into Utilities Oct 5, 2026](https://codekeeper.co/ticker/warlock-ransomware-sharepoint-attacks)

[KnowledgeDeliver LMS Zero-Day Used to Deploy Stealthy In-Memory Web Shell Aug 13, 2026](https://codekeeper.co/ticker/zero-day-flaw-in-knowledgedeliver-lms)

[Russian FSB-Linked Worm Uses Native Windows Feature to Infiltrate Ukrainian Networks Aug 12, 2026](https://codekeeper.co/ticker/fsb-gammaworm-targets-ukraine)

[Software security Five Alleged Black Axe Members Extradited to Face US Charges Sep 15, 2026](https://codekeeper.co/ticker/black-axe-leaders-extradited-romance-scams)