NIXPKGS-2026-0027
published on
Permalink
CVE-2026-23535
8.1 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): LOW
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package wlcs
- @LeSuisse removed package wlclock
- @LeSuisse removed package imewlconverter
- @LeSuisse accepted
- @LeSuisse published on GitHub
wlc Path traversal: Unsanitized API slugs in download command
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.
References
-
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg x_refsource_CONFIRM
-
https://github.com/WeblateOrg/wlc/pull/1128 x_refsource_MISC
-
https://github.com/WeblateOrg/wlc/releases/tag/1.17.2 x_refsource_MISC
Affected products
wlc
- ==< 1.17.2
Package maintainers
-
@paperdigits Mica Semrick <mica@silentumbrella.com>