GNU Wget has a vulnerability in its FTP passive mode where it does not validate the IP address returned by the FTP PASV command. This flaw allows a malicious FTP server or an HTTP server redirecting to an FTP URL to redirect Wget's data connection to an arbitrary IP address and port. Exploiting this can enable server-side request forgery (SSRF), potentially allowing access to localhost or internal network services from the machine running Wget.