Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-23535

wlc Path traversal: Unsanitized API slugs in download command

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WeblateOrg wlc

  • < 1.17.2affected

References