This vulnerability involves an uncontrolled search path element (CWE-427) in GNU Wget Windows builds distributed by eternallybored.org. The hardcoded configuration path C:\msys64 is writable by non-privileged users, which can be exploited through the use_askpass directive to execute arbitrary code locally. This can lead to local privilege escalation. The affected versions include all releases from 0 through 1.21.4. There is no CVSS score or vendor advisory detailing a patch or fix.

An unprivileged local user can exploit the writable hardcoded configuration path to execute arbitrary code with elevated privileges, resulting in local privilege escalation on affected Windows systems running GNU Wget versions up to 1.21.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions to the C:\msys64 directory to trusted users only to mitigate exploitation risk.