new file mode 100644
@@ -0,0 +1,122 @@
+From 17e1d62264c07da2fd748f0714043b856d0925d8 Mon Sep 17 00:00:00 2001
+From: Acts1631 <acts1631kjv@proton.me>
+Date: Sun, 5 Jul 2026 17:22:55 -0400
+Subject: [PATCH] ftp: validate PASV/LPSV response address against control
+ connection peer
+
+* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised
+ address,
+ (ftp_lpsv): Likewise.
+
+ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in
+the server's 227 response without checking that it matched the peer
+of the control connection. A malicious or compromised FTP server
+could therefore direct wget's data connection to an arbitrary host and
+port of its choosing (e.g. an internal service unreachable from the
+attacker directly), which is a server-side request forgery.
+
+ftp_epsv() was already safe since it only extracts a port and reuses
+the pre-filled control-connection address.
+
+Fix ftp_pasv() and ftp_lpsv() the same way: capture the control
+connection's peer address via socket_ip_address() before parsing the
+response, and reject the response (FTPINVPASV) if the parsed address
+does not match.
+
+Verified with a fake FTP server that returns a PASV response pointing
+at a different loopback address (127.0.0.2 instead of the real peer
+127.0.0.1): before the fix wget connects to the spoofed address, after
+the fix it rejects the response with "Cannot parse PASV response."
+Legitimate transfers using a correctly-addressed PASV response
+continue to work.
+
+Copyright-paperwork-exempt: Yes
+
+CVE: CVE-2026-15146
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b]
+
+Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
+---
+ src/ftp-basic.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/src/ftp-basic.c b/src/ftp-basic.c
+index 8f7d19c1..9c7bba1c 100644
+--- a/src/ftp-basic.c
++++ b/src/ftp-basic.c
+@@ -623,10 +623,19 @@ ftp_pasv (int csock, ip_address *addr, int *port)
+ int nwritten, i;
+ uerr_t err;
+ unsigned char tmp[6];
++ ip_address peer_addr;
+
+ assert (addr != NULL);
+ assert (port != NULL);
+
++ /* Remember who we are talking to on the control connection, so that
++ the address returned in the PASV response can be checked below.
++ Accepting an arbitrary server-supplied address would let a
++ malicious FTP server redirect our data connection to any host of
++ its choosing (SSRF). */
++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER))
++ return FTPINVPASV;
++
+ xzero (*addr);
+
+ /* Form the request. */
+@@ -677,6 +686,16 @@ ftp_pasv (int csock, ip_address *addr, int *port)
+ memcpy (IP_INADDR_DATA (addr), tmp, 4);
+ *port = ((tmp[4] << 8) & 0xff00) + tmp[5];
+
++ /* Reject the response if the advertised address does not match the
++ control connection's peer. */
++ if (peer_addr.family != AF_INET
++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0)
++ {
++ xzero (*addr);
++ *port = 0;
++ return FTPINVPASV;
++ }
++
+ return FTPOK;
+ }
+
+@@ -692,10 +711,19 @@ ftp_lpsv (int csock, ip_address *addr, int *port)
+ uerr_t err;
+ unsigned char tmp[16];
+ unsigned char tmpprt[2];
++ ip_address peer_addr;
+
+ assert (addr != NULL);
+ assert (port != NULL);
+
++ /* Remember who we are talking to on the control connection, so that
++ the address returned in the LPSV response can be checked below.
++ Accepting an arbitrary server-supplied address would let a
++ malicious FTP server redirect our data connection to any host of
++ its choosing (SSRF). */
++ if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER))
++ return FTPINVPASV;
++
+ xzero (*addr);
+
+ /* Form the request. */
+@@ -842,6 +870,18 @@ ftp_lpsv (int csock, ip_address *addr, int *port)
+ DEBUGP (("*port is: %d\n", *port));
+ }
+
++ /* Reject the response if the advertised address does not match the
++ control connection's peer. */
++ if (peer_addr.family != addr->family
++ || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr),
++ af == 4 ? 4 : 16) != 0)
++ {
++ xzero (*addr);
++ *port = 0;
++ xfree (respline);
++ return FTPINVPASV;
++ }
++
+ xfree (respline);
+ return FTPOK;
+ }
@@ -19,6 +19,7 @@ SRC_URI = "${GNU_MIRROR}/wget/wget-${PV}.tar.gz \
file://CVE-2026-58470.patch \
file://CVE-2026-58471.patch \
file://CVE-2026-58472.patch \
+ file://CVE-2026-15146.patch \
"
SRC_URI[sha256sum] = "766e48423e79359ea31e41db9e5c289675947a7fcf2efdcedb726ac9d0da3784"