Most recent entries from all

EUVD-2026-265963

fkie_cve-2026-23535

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.

GHSA-mmwx-79f6-67jg — Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Affected: PyPI: wlc

### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server.

### Patches * https://github.com/WeblateOrg/wlc/pull/1128

### Workarounds Do not use `wlc download` with untrusted servers.

### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

PYSEC-2026-2053 — Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Affected: PyPI: wlc

### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server.

### Patches * https://github.com/WeblateOrg/wlc/pull/1128

### Workarounds Do not use `wlc download` with untrusted servers.

### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

UBUNTU-CVE-2026-23535

Affected: Ubuntu:Pro:18.04:LTS: wlc, Ubuntu:Pro:20.04:LTS: wlc, Ubuntu:Pro:22.04:LTS: wlc, Ubuntu:Pro:24.04:LTS: wlc, Ubuntu:25.10: wlc, Ubuntu:26.04:LTS: wlc