GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs

GNU Wget can be tricked into accessing unintended servers when users provide malicious credentials in shorthand URLs. This matters because attackers can bypass security controls and access internal systems or sensitive resources they shouldn't reach.

SSRF vulnerability in GNU Wget occurs when applications pass user-controlled credentials via shorthand URLs without proper validation. An attacker can craft malicious credentials that alter the target host, bypassing URL restrictions and allowing access to arbitrary internal or external resources, provided the application uses Wget with user-supplied credentials.