The vulnerability in GNU Wget arises from improper validation of the IP address provided by an FTP PASV response during FTP passive mode operations. This enables an attacker controlling an FTP server or an HTTP server redirecting to FTP to redirect Wget's data connection to an arbitrary IP and port. Consequently, this can be exploited to forge server-side requests (SSRF) from the affected host, potentially allowing access to internal or localhost services. The issue affects multiple specific Ubuntu package versions of Wget as enumerated. There is no vendor advisory or patch information provided in the input data.

Exploitation of this vulnerability allows an attacker to perform SSRF attacks from the victim machine running Wget. This can lead to unauthorized access to internal network services or localhost resources that would otherwise be inaccessible externally. The impact includes potential confidentiality, integrity, and availability loss on internal services due to forged requests originating from the vulnerable host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using Wget with untrusted FTP servers or HTTP servers that redirect to FTP URLs. Monitoring and restricting outbound FTP connections may reduce exposure.