Listen to this Post
The vulnerability, CVE-2025-XXXXX, exists within the `wlc download` command of the Weblate CLI tool. The issue is a lack of proper sanitization for API response slugs. When `wlc` communicates with a Weblate server to download multiple translation files, it constructs local file paths using directory and file names (slugs) provided by the server’s API. A malicious or compromised server can craft API responses containing path traversal sequences (e.g., ../../../../etc/passwd) within these slugs. The `wlc` client fails to validate or neutralize these sequences before using them to write files. Consequently, when the `wlc download` command executes, it follows the crafted path, writing the downloaded translation content to an arbitrary filesystem location determined by the attacker, leading to arbitrary file write or overwrite.
Platform: Weblate CLI (wlc)
Version: Prior to patched
Vulnerability: Path Traversal
Severity: High
date: Jan 16 2026
Prediction: Patch by Jan 30 2026
What Undercode Say:
$ wlc download –server https://malicious-weblate.instance.example.com/project/
$ cat downloaded_files/../../../../tmp/pwned
$ find / -name “.mo” -newer /tmp/reference -exec ls -la {} \;
How Exploit:
1. Attacker controls a Weblate server instance.
- Victim uses `wlc download` pointing to attacker’s server.
- Attacker’s API responds with malicious paths in `slug` fields (e.g.,
"slug": "../../../etc/cron.d/payload").
4. `wlc` writes translation file to the traversed path, achieving arbitrary file write.
Protection from this CVE:
1. Update `wlc` to a patched version.
2. Sanitize API slugs on client-side.
3. Run `wlc` with restrictive user permissions.
4. Only download from trusted servers.
Impact:
Arbitrary File Write
Potential Code Execution
System Compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
