Weblate command-line client susceptible to SSL verification skip

中危 5.5CVE-2026-22250 · GHSA-2mmv-7rrp-g8xh · PYSEC-2026-2051 · Published 12/01/2026 · updated 17/06/2026

要点

CVE-2026-22250 是影响 wlc, wlc (weblate) 的中危 (CVSS 5.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.15%，高于 4.5% 的漏洞。
修复：升级到 1.17.0 或更高版本。

Package	Affected versions	Patched versions
wlc PyPI	`< 1.17.0`	`1.17.0`
wlc weblate	`< 1.17.0`	`1.17.0`

Description

Impact

The SSL verification would be skipped for some crafted URLs.

Patches

https://github.com/WeblateOrg/wlc/pull/1097

Workarounds

Avoid using untrusted wlc configurations, as that might cause insecure connections.

References

This issue was reported to us by wh1zee via HackerOne.

NVD description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

References

WeblateOrg/wlc security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-22250 · ADVISORY
WeblateOrg/wlc#1097 · WEB
WeblateOrg/wlc commit a513864 · WEB
WeblateOrg/wlc · PACKAGE
pypi.org/project/wlc · PACKAGE
GitHub Advisory GHSA-2mmv-7rrp-g8xh · ADVISORY

wlc 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wlc

PyPI

< 1.17.0

1.17.0

wlc

weblate

< 1.17.0

1.17.0

Description

Impact

The SSL verification would be skipped for some crafted URLs.

Patches

https://github.com/WeblateOrg/wlc/pull/1097

Workarounds

Avoid using untrusted wlc configurations, as that might cause insecure connections.

References

This issue was reported to us by wh1zee via HackerOne.

NVD description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

wlc 的其他漏洞

查看全部 →