CVE-2018-20483: set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.ur...

Security readout for executives and security teams

GNU Wget before 1.20.1 could save downloaded files with hidden metadata containing the origin or referrer URL. If those URLs included credentials or tokens, another local user able to read the file metadata could learn sensitive information. This is a local information-disclosure issue, not evidence of remote compromise. Exposure is most likely on multi-user Linux or Unix-like systems using GNU Wget before 1.20.1, especially automation that downloads from URLs containing credentials, tokens, or sensitive referrers and preserves extended attributes. Treat as a targeted hygiene fix, not an emergency, unless Wget was used with secrets in URLs on shared systems. Prioritize patching shared servers, build machines, jump hosts, and automation environments. Mitigation focus: Upgrade GNU Wget to a vendor-fixed package, at least 1.20.1 where applicable.; Review Gentoo, Ubuntu, Red Hat, and NetApp advisories for platform-specific fixed versions.; Avoid embedding credentials, tokens, or secrets in URLs used by download automation..

Prepared

Jun 6, 2026, 22:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.