PT-2026-2288 · Weblate+3 · Weblate+3

Zee99Y · Published 2026-01-12 · Updated 2026-01-27 · CVE-2026-22250

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 1.17.0

Description The Weblate command-line client, wlc, which utilizes Weblate's REST API, had a flaw where SSL verification was bypassed for specific, manipulated URLs. This could potentially allow for man-in-the-middle attacks. The issue was addressed in version 1.17.0. The vulnerable component interacts with Weblate's REST API endpoints.

Recommendations Update to version 1.17.0 or later.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-22250

GHSA-2MMV-7RRP-G8XH

USN-7981-1

Affected Products

Linuxmint

Ubuntu

Weblate

Wlc

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22250.json · Exploit
• https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3 · Patch
• https://ubuntu.com/security/notices/USN-7981-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-22250 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22250 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2mmv-7rrp-g8xh · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22250 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22250 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7981-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22251 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22250 · Security Note
• https://github.com/WeblateOrg/wlc · Note
• https://github.com/WeblateOrg/wlc/pull/1097 · Note