PT-2026-3302 · Wlc+1 · Wlc+1

Zee99Y · Published 2026-01-01 · Updated 2026-02-18 · CVE-2026-23535

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weblate wlc versions prior to 1.17.2

Description The Weblate command-line client (wlc), which uses Weblate's REST API, is susceptible to an arbitrary file write issue. A crafted server can instruct the multi-translation download functionality to write files to an unintended location. This is due to unsanitized API slugs. The issue allows a malicious or compromised Weblate server to write arbitrary files to the client system. The vulnerability is related to the wlc download command.

Recommendations Versions prior to 1.17.2 should be updated to version 1.17.2. As a workaround, avoid using the wlc download command with untrusted servers.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23535

GHSA-MMWX-79F6-67JG

Affected Products

Weblate

Wlc

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23535.json · Exploit
• https://github.com/WeblateOrg/wlc/pull/1128 · Patch
• https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f · Patch
• https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23535 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23535 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23535 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23535 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23535 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mmwx-79f6-67jg · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23535 · Vendor Advisory
• https://github.com/WeblateOrg/wlc · Note
• https://github.com/WeblateOrg/wlc/releases/tag/1.17.2 · Note
• https://twitter.com/TheHackerWire/status/2012253690514530742 · Twitter Post