A path traversal vulnerability in GNU Wget2 versions 2.2.0 and earlier allows unauthenticated attackers to overwrite arbitrary files, presenting a critical risk of system compromise.

The application fails to perform adequate path validation when processing Metalink file name elements, which allows an unauthenticated attacker to escape the intended directory and perform arbitrary file writes.

Successful exploitation of this flaw can result in the corruption of critical system files, the injection of malicious scripts, or the unauthorized modification of configuration data. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that could lead to full system compromise depending on the context in which Wget2 is executed.

Immediate Action: Update GNU Wget2 to version 2.2.1 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Review system logs for unusual file write activity or Wget2 processes initiated with suspicious or malformed Metalink input files.

Compensating Controls: Ensure that instances of Wget2 are executed with the minimum necessary privileges, preferably within a restricted container or sandbox environment to limit the impact of file system access.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the ability of this vulnerability to facilitate arbitrary file writes, organizations using GNU Wget2 must prioritize patching to version 2.2.1. Verify that all automated scripts and build pipelines utilizing Wget2 are updated to the latest secure version to prevent potential remote code execution or system instability.