GHSA-mmwx-79f6-67jg

Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Source: GitHub Advisory Database (reviewed) High CVE-2026-23535

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	wlc	< 1.17.2	1.17.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server. ### Patches * https://github.com/WeblateOrg/wlc/pull/1128 ### Workarounds Do not use `wlc download` with untrusted servers. ### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

References

External links from the advisory. They lead to third-party sites.

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg web
https://nvd.nist.gov/vuln/detail/CVE-2026-23535 advisory
https://github.com/WeblateOrg/wlc/pull/1128 web
https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f web
https://github.com/WeblateOrg/wlc package
https://github.com/WeblateOrg/wlc/releases/tag/1.17.2 web