CVE-2026-22250

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

CVSS v3 2.5 LOW

2.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3	Patch
https://github.com/WeblateOrg/wlc/pull/1097	Issue Tracking
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:19

Type	Values Removed	Values Added
Summary		(es) wlc es un cliente de línea de comandos de Weblate que utiliza la API REST de Weblate. Antes de la versión 1.17.0, la verificación SSL se omitiría para algunas URL manipuladas. Esta vulnerabilidad está corregida en la versión 1.17.0.

27 Jan 2026, 20:37

Type	Values Removed	Values Added
References	~~() https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3 -~~	() https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3 - Patch
References	~~() https://github.com/WeblateOrg/wlc/pull/1097 -~~	() https://github.com/WeblateOrg/wlc/pull/1097 - Issue Tracking
References	~~() https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh -~~	() https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh - Third Party Advisory
CPE		cpe:2.3:a:weblate:wlc::::::::
First Time		Weblate wlc Weblate

12 Jan 2026, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-12 18:15

Updated : 2026-06-17 10:19

NVD link : CVE-2026-22250

Mitre link : CVE-2026-22250

CVE.ORG link : CVE-2026-22250

JSON object : View

Products Affected

weblate

wlc

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-22250", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22250", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-12T18:05:29.339306Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WeblateOrg", "product": "wlc", "versions": [{"status": "affected", "version": "< 1.17.0"}]}]}], "published": "2026-01-12T18:15:49.307", "references": [{"url": "https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/pull/1097", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0."}, {"lang": "es", "value": "wlc es un cliente de l\u00ednea de comandos de Weblate que utiliza la API REST de Weblate. Antes de la versi\u00f3n 1.17.0, la verificaci\u00f3n SSL se omitir\u00eda para algunas URL manipuladas. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.17.0."}], "lastModified": "2026-06-17T10:19:38.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B01083E5-842F-4D93-8069-D4578C071C90", "versionEndExcluding": "1.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}