Absolute path traversal vulnerability in GNU Wget before 1.16 when recursion is enabled allows remote FTP servers to write to arbitrary files and consequently execute arbitrary code via a LIST response that references the same filename within two entries one of which indicates that the filename is for a symlink.