GHSA-mmwx-79f6-67jg

Source

https://github.com/advisories/GHSA-mmwx-79f6-67jg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-mmwx-79f6-67jg/GHSA-mmwx-79f6-67jg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mmwx-79f6-67jg

Aliases

CVE-2026-23535

Published

2026-01-16T16:58:26Z

Modified

2026-01-16T22:21:48.140913Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

Details

Impact

Multi-translation download could write to an arbitrary location when instructed by a crafted server.

Patches

https://github.com/WeblateOrg/wlc/pull/1128

Workarounds

Do not use wlc download with untrusted servers.

References

This issue was reported to us by wh1zee via HackerOne.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed_at": "2026-01-16T16:58:26Z",
    "nvd_published_at": "2026-01-16T19:16:19Z"
}

References

Affected packages

PyPI / wlc

Package

Name: wlc; View open source insights on deps.dev
Purl: pkg:pypi/wlc

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.17.2

Affected versions

0.*

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

0.10

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16.1

1.17.0

1.17.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-mmwx-79f6-67jg/GHSA-mmwx-79f6-67jg.json"