{"id":153405,"date":"2026-01-05T17:12:15","date_gmt":"2026-01-05T15:12:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-gnu-wget2-2-2-1-ustranena-uyazvimost-dopuskayushhaya-perezapis-proizvolnyh-fajlov"},"modified":"2026-01-05T17:12:15","modified_gmt":"2026-01-05T15:12:15","slug":"v-gnu-wget2-2-2-1-ustranena-uyazvimost-dopuskayushhaya-perezapis-proizvolnyh-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-gnu-wget2-2-2-1-ustranena-uyazvimost-dopuskayushhaya-perezapis-proizvolnyh-fajlov","title":{"rendered":"Dans GNU Wget2 2.2.1, une vuln\u00e9rabilit\u00e9 permettant la r\u00e9\u00e9criture de fichiers arbitraires a \u00e9t\u00e9 corrig\u00e9e.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
La sortie du projet GNU Wget2 2.2.1 est disponible, d\u00e9veloppant une version enti\u00e8rement r\u00e9\u00e9crite et remani\u00e9e du programme pour automatiser le t\u00e9l\u00e9chargement r\u00e9cursif de contenu de GNU Wget. Wget2 offre un ensemble d'options suppl\u00e9mentaires, prend en charge les t\u00e9l\u00e9chargements multithreads, permet d'utiliser les fonctionnalit\u00e9s disponibles via la biblioth\u00e8que libwget, prend en charge les protocoles HTTP\/2 et TLS 1.3, permet de t\u00e9l\u00e9charger uniquement les donn\u00e9es modifi\u00e9es, peut conserver les donn\u00e9es des serveurs de streaming, traite correctement les noms de domaine internationalis\u00e9s et peut re-encoder le contenu t\u00e9l\u00e9charg\u00e9. L'outil wget2 est distribu\u00e9 sous la licence GPLv3+, tandis que la biblioth\u00e8que est sous LGPLv3+. <\/p>\n
La nouvelle version corrige deux vuln\u00e9rabilit\u00e9s : <\/p>\n
\n
CVE-2025-69194 \u2014 absence of proper path verification when processing Metalink format content, used to describe download file links. By using the sequence '.. \/' in file paths within the block, an attacker can create, delete, or overwrite arbitrary files outside the base directory where the download occurs. For instance, an attacker could overwrite the content of ~\/ .ssh\/authorized_keys or ~\/ .bashrc and execute their code on the system.\n
CVE-2025-69195 \u2014 buffer overflow in the file name cleanup code in the function get_local_filename_real(), potentially leading to code execution when processing specially crafted URLs on uploaded pages or when handling redirects. The problem manifests when the option '--restrict-file-names=windows|unix|ascii' is enabled and is caused by allocating a fixed 1024-byte buffer without checking the actual size of the data being written. <\/ul>\n