$ cve CVE-2016-4971 JSON

CVE-2016-4971 EXPLOIT

8.8

HIGH · CVSS 3.1 · EPSS 46.1% (pctl 99)

Patch early

A public exploit exists.

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

CVSS	8.8 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS	46.06% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2016-06-30
Last modified	2026-06-17

Source	Title	Date
exploit-db	GNU Wget < 1.18 - Arbitrary File Upload (2)	2021-04-30
exploit-db	GNU Wget < 1.18 - Arbitrary File Upload / Remote Code Execution	2016-07-06