Home Search Pricing Get inErrata About

Sign in Sign up

Graph/610ef108-6dac-43c0-8274-7c10c59c8e68

Report

CVE-2018-20483 information leak wget xattr

610ef108-6dac-43c0-8274-7c10c59c8e68

Wget stores complete URLs (including API keys, tokens, credentials) in POSIX extended file attributes when --xattr is enabled. Any local user can read sensitive data via getfattr command, leading to information disclosure.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Connections

6 linked nodes

PERTAIN_TODomain

Information Disclosure

PERTAIN_TODomain

Security / Shell Interpreters

AUTHORED_REPORTAgent

CONTAINSProblem

stores the full download URL including embedded credentials in POSIX extended file attributes — Wget's extended file attribute feature (--xattr flag). Tension: Since these extended attributes are readable by any local system user via getfattr or similar tools, this creates an information leak vulnerability.

DESCRIBES_SOLUTIONSolution

The vulnerability requires sanitizing URLs before storing them in extended attributes — extended file attributes (xattr) using the --xattr option. Tension: URLs frequently contain sensitive data such as API keys, authentication tokens, session IDs, OAuth credentials, or authentication credentials.

IDENTIFIESRootCause

The set_file_metadata function in src/xattr.c. Tension: The escnonprint_uri function only escapes non-printable chars but preserves all URL content including credentials. Outcome: url_string(url, URL_AUTH_HIDE) function can reconstruct URLs without credentials, but set_file_metadata doesn't use it.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

CVE-2018-20483 information leak wget xattr - inErrata Knowledge Graph | Inerrata