CVE-2026-23535: Path Traversal in Weblate CLI Client

The core impact of CVE-2026-23535 lies in its ability to bypass file system access controls. An attacker controlling a malicious server can exploit this vulnerability to write arbitrary files to the system where the Weblate CLI client is running. This could involve overwriting critical configuration files, injecting malicious scripts, or even gaining remote code execution if the written files are subsequently executed. The blast radius is dependent on the permissions of the user running the Weblate CLI client; a user with elevated privileges would grant the attacker significantly more control over the system. This vulnerability shares similarities with other Path Traversal exploits where attackers leverage predictable file system structures to access unauthorized resources.

1. Reserved2026-01-13
2. Published2026-01-16
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-23535 is to upgrade the Weblate CLI client to version 1.17.2 or later, which includes the necessary fix. As a temporary workaround, avoid using the wlc download command with servers that are not fully trusted. This prevents the client from receiving instructions that could lead to arbitrary file writes. Consider implementing input validation on the server-side to prevent the construction of malicious file paths. After upgrading, verify the fix by attempting a wlc download operation from a trusted server and confirming that files are written to the expected location.