Executive brief
Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
Affected products
- PyPI wlc
Junglewise Threat Intelligence
CVE-2026-23535: PYSEC-2026-2053 - Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
CVE-2026-23535 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: wlc (PyPI). Vendors: PyPI.
Related threats
- wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblat
- PYSEC-2026-2052 - Weblate wlc has insecure API key configuration
- PYSEC-2026-2051 - Weblate command-line client susceptible to SSL verification skip
- Weblate wlc cross-site scripting in HTML output format