A local code execution vulnerability in GNU Wget for Windows allows unprivileged users to escalate privileges by exploiting a predictable and writable configuration file path.

The flaw is categorized as an Uncontrolled Search Path Element (CWE-427), where the application references a hardcoded directory (C:\msys64) that is writable by unprivileged users. An attacker can leverage the use_askpass directive to execute arbitrary code with the privileges of the user running Wget.

This vulnerability poses a significant risk to local system integrity and confidentiality. By manipulating the configuration file, a local attacker can achieve arbitrary code execution, potentially leading to full system compromise or lateral movement within the local environment. Given the CVSS score of 7.8, this is a high-severity issue that necessitates immediate attention in environments where multi-user access is permitted on Windows workstations or servers.

Immediate Action: Restrict write permissions on the C:\msys64 directory to administrators only, and monitor the vendor website for a security update that addresses the hardcoded path.

Proactive Monitoring: Review system logs for unauthorized modifications to configuration files or unexpected processes spawned by the Wget executable.

Compensating Controls: Implement strict file system access control lists (ACLs) on the affected directory to prevent unauthorized modification by non-administrative users.

Public Exploit Available: Unknown.

The vulnerability represents a critical security oversight in the affected Windows builds of Wget. Organizations should prioritize remediating file system permissions to remove write access for non-privileged accounts from the C:\msys64 path. Until a formal patch is released by the vendor, limiting the execution of Wget or restricting access to the affected directory is the most effective way to mitigate the risk of local code execution.