Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

高危 8.0CVE-2026-23535 · GHSA-mmwx-79f6-67jg · PYSEC-2026-2053 · Published 16/01/2026 · updated 17/06/2026

要点

CVE-2026-23535 是影响 wlc, wlc (weblate) 的高危 (CVSS 8.0)漏洞。
未来 30 天内被利用的概率（EPSS）：0.39%，高于 32.8% 的漏洞。
修复：升级到 1.17.2 或更高版本。

Package	Affected versions	Patched versions
wlc PyPI	`< 1.17.2`	`1.17.2`
wlc weblate	`< 1.17.2`	`1.17.2`

Description

Impact

Multi-translation download could write to an arbitrary location when instructed by a crafted server.

Patches

https://github.com/WeblateOrg/wlc/pull/1128

Workarounds

Do not use wlc download with untrusted servers.

References

This issue was reported to us by wh1zee via HackerOne.

NVD description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.

References

WeblateOrg/wlc security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-23535 · ADVISORY
WeblateOrg/wlc#1128 · WEB
WeblateOrg/wlc commit 216e691 · WEB
WeblateOrg/wlc · PACKAGE
WeblateOrg/wlc release 1.17.2 · WEB
pypi.org/project/wlc · PACKAGE
GitHub Advisory GHSA-mmwx-79f6-67jg · ADVISORY

wlc 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wlc

PyPI

< 1.17.2

1.17.2

wlc

weblate

< 1.17.2

1.17.2

Description

Impact

Multi-translation download could write to an arbitrary location when instructed by a crafted server.

Patches

https://github.com/WeblateOrg/wlc/pull/1128

Workarounds

Do not use wlc download with untrusted servers.

References

This issue was reported to us by wh1zee via HackerOne.

NVD description

wlc 的其他漏洞

查看全部 →