Launchpad.net

CVE 2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

See the CVE page on Mitre.org for more details.