GitHub Advisoryadvisory · PyPI

GHSA-mmwx-79f6-67jg Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

HIGH Published 2026-01-16 Modified 2026-01-16 Official page ↗
Aliases
CVE-2026-23535
Ecosystem
PyPI
Packages
wlc
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2026-01-16

Affected packages

• PyPI wlc: < 1.17.2 → fixed in 1.17.2

Description

Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server. Patches • https://github.com/WeblateOrg/wlc/pull/1128 Workarounds Do not use `wlc download` with untrusted servers. References This issue was reported to us by wh1zee via HackerOne.

Related

Alias · CVE (1)

  • CVE-2026-23535 wlc is a Weblate command-line client using Weblate's REST API. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References