CVE-2026-15146 is an SSRF vulnerability in GNU Wget's FTP passive mode where the client does not validate the IP address provided by the FTP server's PASV response. An attacker controlling or influencing the FTP endpoint can redirect Wget's data connection to arbitrary internal IP addresses and ports, potentially accessing internal network resources or localhost services. This vulnerability affects Wget versions 1.25.0 and earlier and was remediated in a commit dated July 5, 2026. The vulnerability is similar to previously known FTP PASV issues such as CVE-2021-40491 in GNU Inetutils.

A remote attacker who controls or influences an FTP server or an HTTP server redirecting to an FTP URL can cause Wget to connect to arbitrary IP addresses and ports within the victim's internal network. This can lead to unauthorized access to internal services, retrieval of service banners, or data exfiltration from internal systems accessible to the host running Wget. Automated applications embedding Wget are particularly at risk due to potential automatic triggering via redirects or untrusted URLs.

A fix for this vulnerability has been released by GNU in a commit dated July 5, 2026. Users are advised to update Wget to the latest version containing this fix. Patch status is confirmed by the vendor commit. No additional mitigation steps are indicated in the vendor advisory.