
CVE-2016-4971 written in nodejs
On a server redirect from HTTP to a FTP resource, wget would trust the HTTP server and uses the name in the redirected URL as the destination filename.
See the post on my blog for some detail.
On your server,
node wget.js
On your test computer,
wget http://url.to.your/server
screenshot 1
screenshot 2