{"id":"CVE-2026-23535","aliases":["DEBIAN-CVE-2026-23535","EUVD-2026-2864","GHSA-mmwx-79f6-67jg","PYSEC-2026-2053","UBUNTU-CVE-2026-23535"],"status":"published","title":"wlc Path traversal: Unsanitized API slugs in download command","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00387,"percentile":0.33104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-01-16T16:58:26Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"PyPI","package":"wlc","fixed_in":["1.17.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"wlc","fixed_in":["1.17.2-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-2","1.14-1","1.15-1","1.15-2","1.16.1-1","1.17.2-1","2.0.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-1","1.15-2","1.16.1-1","1.17.2-1","2.0.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2-1"}]}],"versions":["1.15-1","1.15-2","1.16.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2"}]}],"versions":["0.0","0.1","0.10","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16.1","1.17.0","1.17.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"PyPI","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2"}]}],"versions":["0.0","0.1","0.10","0.2","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16.1","1.17.0","1.17.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8-1","0.8-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1-1","1.2-1","1.2-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-1","1.2-1ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13-2","1.13-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-1","1.15-2","1.15-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-1","2.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-2","1.16.1-1"]}],"products":[{"vendor":"weblate","product":"wlc"},{"vendor":"weblateorg","product":"wlc"}],"references":[{"url":"https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg","tags":["x_refsource_CONFIRM","Mitigation","Patch","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/pull/1128","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/WeblateOrg/wlc/releases/tag/1.17.2","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23535","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mmwx-79f6-67jg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23535.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23535","tags":["advisory"]},{"url":"https://github.com/WeblateOrg/wlc","tags":["package"]},{"url":"https://pypi.org/project/wlc","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-23535","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23535","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-23535","title":"wlc Path traversal: Unsanitized API slugs in download command","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","status":"published","published":"2026-01-16T19:08:24.882Z","modified":"2026-01-16T19:21:22.629Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-2864","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","status":"published","published":"2026-01-16T19:08:24Z","modified":"2026-01-16T19:21:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:50.882066Z"}],"ghsa":[{"id":"GHSA-mmwx-79f6-67jg","title":"Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command ","description":"### Impact\nMulti-translation download could write to an arbitrary location when instructed by a crafted server.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1128\n\n### Workarounds\nDo not use `wlc download` with untrusted servers.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.","status":"published","published":"2026-01-16T16:58:26Z","modified":"2026-01-16T21:56:10Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:18.564331Z"}],"nvd":[{"id":"CVE-2026-23535","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","status":"published","published":"2026-01-16T19:16:19.407Z","modified":"2026-06-17T10:21:44.783Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-23535","title":"wlc Path traversal: Unsanitized API slugs in download command","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","status":"published","published":"2026-01-16T19:08:24.882Z","modified":"2026-10-28T02:31:04.130594704Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"DEBIAN-CVE-2026-23535","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","status":"published","published":"2026-01-16T19:16:19.407Z","modified":"2026-10-01T03:03:00.703051199Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.516942Z"},{"id":"GHSA-mmwx-79f6-67jg","title":"Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command ","description":"### Impact\nMulti-translation download could write to an arbitrary location when instructed by a crafted server.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1128\n\n### Workarounds\nDo not use `wlc download` with untrusted servers.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.","status":"published","published":"2026-01-16T16:58:26Z","modified":"2026-07-07T17:57:36.105095146Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"PYSEC-2026-2053","title":"Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command ","description":"### Impact\nMulti-translation download could write to an arbitrary location when instructed by a crafted server.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1128\n\n### Workarounds\nDo not use `wlc download` with untrusted servers.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.","status":"published","published":"2026-07-07T16:03:18.960085Z","modified":"2026-07-07T17:46:16.714544853Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2026-23535","description":"wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.","status":"published","published":"2026-01-16T19:16:00Z","modified":"2026-10-17T12:58:07.212235433Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:04.456047Z"}]}}