CVE-2026-23535
📋 TL;DR
This vulnerability in the Weblate command-line client (wlc) allows a malicious Weblate server to write files to arbitrary locations on a client's system during multi-translation downloads. Attackers controlling or compromising a Weblate server could exploit this to overwrite critical files or deploy malware. Users of wlc versions before 1.17.2 who download translations from untrusted or compromised servers are affected.
💻 Affected Systems
- Weblate command-line client (wlc)
📦 What is this software?
Wlc by Weblate
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data destruction, or persistence mechanisms.
Likely Case
Local file corruption, configuration file overwrites, or deployment of malicious scripts in user-writable directories.
If Mitigated
Limited impact if only trusted servers are accessed and proper file permissions restrict write access to sensitive locations.
🎯 Exploit Status
Exploitation requires client to connect to a malicious Weblate server; no authentication bypass needed as server controls the response.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.17.2
Vendor Advisory: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
Restart Required: No
Instructions:
1. Update wlc using pip: 'pip install --upgrade wlc==1.17.2' 2. Verify installation with 'wlc --version' 3. No restart required.
🔧 Temporary Workarounds
Restrict to trusted servers
allOnly use wlc with known, trusted Weblate server instances.
Disable multi-translation downloads
allAvoid using the multi-translation download feature if not required.
🧯 If You Can't Patch
- Run wlc with restricted user permissions to limit file write capabilities
- Use containerization or sandboxing to isolate wlc execution
🔍 How to Verify
Check if Vulnerable:
Run 'wlc --version' and check if version is less than 1.17.2.Check Version:
wlc --versionVerify Fix Applied:
Run 'wlc --version' and confirm version is 1.17.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes in system directories
- wlc processes writing to unusual locations
Network Indicators:
- wlc connections to unknown or suspicious Weblate servers
SIEM Query:
Process execution where command_line contains 'wlc' AND (file_write_path contains sensitive_directories OR destination_ip not in trusted_servers)