CVE-2026-23535
High · 8.0CVSS
8.0
EPSS
0.4%
Published
Jan 16, 2026
CISA due date
—
The record
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | wlc | 0 | 1.17.2 |
Related vulnerabilities
- GHSA-mmwx-79f6-67jg Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command Same vulnerability
- GHSA-9rp8-h4g8-8766 Weblate wlc has insecure API key configuration Also affects wlc
- GHSA-2mmv-7rrp-g8xh Weblate command-line client susceptible to SSL verification skip Also affects wlc
- CVE-2026-22251 Weblate wlc has insecure API key configuration Also affects wlc
- CVE-2026-22250 Weblate command-line client susceptible to SSL verification skip Also affects wlc
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22