CVE-2026-23535: Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command

January 16, 2026

Multi-translation download could write to an arbitrary location when instructed by a crafted server.

References

github.com/WeblateOrg/wlc
github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f
github.com/WeblateOrg/wlc/pull/1128
github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg
github.com/advisories/GHSA-mmwx-79f6-67jg
nvd.nist.gov/vuln/detail/CVE-2026-23535

Code Behaviors & Features

Detect and mitigate CVE-2026-23535 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →