Executive brief
Weblate's command-line client (wlc) is a tool for managing translations and content synchronization with Weblate servers. The application contains a flaw that allows SSL/TLS certificate verification to be bypassed when connecting to certain crafted URLs, potentially exposing users to man-in-the-middle attacks where an attacker could intercept and modify communications between the client and server.
Technical details
This vulnerability is a certificate validation bypass (CWE-295) in the Weblate command-line client. The flaw causes SSL verification to be skipped for specially crafted URLs. The attack vector is local with high attack complexity, requiring low privileges and user interaction (e.g., the user must utilize a malicious or compromised configuration file). An attacker with the ability to influence the wlc configuration could trick the client into connecting to a server without proper SSL certificate validation, enabling interception of credentials and data in transit. The vulnerability has been patched in version 1.17.0; users running versions prior to that should upgrade immediately and avoid using untrusted configurations.
Affected products
- Weblate wlc < 1.17.0
Timeline
- 2026-01-12: disclosed
- 2026-01-12: patched: Version 1.17.0 released with fix