Security readout for executives and security teams
Plain-English summary
CVE-2026-23535 affects wlc, the Weblate command-line client. Before version 1.17.2, a crafted server response could cause a multi-translation download to write files outside the intended directory. This can threaten confidentiality, integrity, and availability on systems where wlc is run.
Executive priority
Prioritize remediation where wlc runs in CI/CD, release, or developer environments with access to source code or credentials. Upgrade is the clearest fix, and no public source here confirms active exploitation.
Technical view
This is a CWE-22 path traversal issue in wlc’s multi-translation download handling. Unsanitized API slugs from a server could influence local write paths. The CVSS 3.1 score is 8.1, with network attack vector, high complexity, low privileges, required user interaction, changed scope, and high CIA impact.
Likely exposure
Exposure is likely limited to environments using WeblateOrg wlc versions earlier than 1.17.2, especially developer workstations or automation that run multi-translation downloads against untrusted, compromised, or attacker-controlled Weblate-compatible servers.
Exploitation context
The sources do not report active exploitation, and this CVE is not marked KEV. Exploitation requires a crafted server and user interaction with the vulnerable client workflow, but successful exploitation could write files to arbitrary local locations.
Researcher notes
The fix is associated with release 1.17.2, pull request 1128, and commit 216e691c6e50abae97fe2e4e4f21501bf49a585f. Available sources indicate path validation was insufficient for server-provided slugs during multi-translation downloads.
Mitigation direction
- Upgrade WeblateOrg wlc to version 1.17.2 or later.
- Avoid using vulnerable wlc versions with untrusted Weblate servers.
- Review automation that downloads translations using wlc.
- Check vendor advisory and release notes for any additional guidance.
Validation and detection
- Inventory installed wlc versions on developer systems and CI runners.
- Confirm wlc is version 1.17.2 or later.
- Identify workflows using multi-translation download commands.
- Review recent download outputs for unexpected file paths or overwritten files.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23535 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H1.36Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jgCVE reference · x_refsource_CONFIRM
- https://github.com/WeblateOrg/wlc/pull/1128CVE reference · x_refsource_MISC
- https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585fCVE reference · x_refsource_MISC
- https://github.com/WeblateOrg/wlc/releases/tag/1.17.2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.