Wlc
Monthly
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path traversal when downloading multi-translations from a malicious or compromised server. An authenticated attacker can exploit this vulnerability by crafting a specially designed server response to write files to arbitrary locations on the victim's system, potentially compromising system integrity. This vulnerability affects wlc versions before 1.17.2 and is fixed in the patched version.
API token disclosure in the Weblate wlc command-line client before 2.0.1 allows an attacker-controlled project configuration to redirect an unscoped API token to a server the attacker controls. When wlc is run inside an untrusted repository, pull-request checkout, or a directory with an untrusted ancestor whose .weblate, .weblate.ini, or weblate.ini sets an API url, and the operator supplies a token through WLC_KEY or --key without also pinning WLC_URL or --url, the client transmits that token to the project-configured destination. Exploitation requires local execution of wlc, all three configuration preconditions to hold simultaneously, and user interaction; no public exploit was identified at time of analysis, and the overall risk is low (CVSS 2.3 / assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
Cross-site scripting in wlc command-line client versions prior to 2.0.0 allows authenticated users with high privileges to inject malicious HTML/JavaScript into API responses, which are then embedded unescaped in HTML output. When the HTML output is rendered in a browser, this enables XSS attacks. The vulnerability requires explicit use of the HTML output format (non-default), user interaction to open/view the HTML file, and elevated API credentials, limiting real-world risk despite the network vector.
Wlc versions prior to 1.17.0 fail to restrict unscoped API keys, allowing them to be transmitted to unintended Weblate servers and potentially leaked to attackers with local access or through compromised credentials. A local attacker with user privileges could exploit this information disclosure to gain unauthorized access to Weblate instances across multiple servers. A patch is available in version 1.17.0 and later.
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. [CVSS 2.5 LOW]
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path traversal when downloading multi-translations from a malicious or compromised server. An authenticated attacker can exploit this vulnerability by crafting a specially designed server response to write files to arbitrary locations on the victim's system, potentially compromising system integrity. This vulnerability affects wlc versions before 1.17.2 and is fixed in the patched version.
API token disclosure in the Weblate wlc command-line client before 2.0.1 allows an attacker-controlled project configuration to redirect an unscoped API token to a server the attacker controls. When wlc is run inside an untrusted repository, pull-request checkout, or a directory with an untrusted ancestor whose .weblate, .weblate.ini, or weblate.ini sets an API url, and the operator supplies a token through WLC_KEY or --key without also pinning WLC_URL or --url, the client transmits that token to the project-configured destination. Exploitation requires local execution of wlc, all three configuration preconditions to hold simultaneously, and user interaction; no public exploit was identified at time of analysis, and the overall risk is low (CVSS 2.3 / assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
Cross-site scripting in wlc command-line client versions prior to 2.0.0 allows authenticated users with high privileges to inject malicious HTML/JavaScript into API responses, which are then embedded unescaped in HTML output. When the HTML output is rendered in a browser, this enables XSS attacks. The vulnerability requires explicit use of the HTML output format (non-default), user interaction to open/view the HTML file, and elevated API credentials, limiting real-world risk despite the network vector.
Wlc versions prior to 1.17.0 fail to restrict unscoped API keys, allowing them to be transmitted to unintended Weblate servers and potentially leaked to attackers with local access or through compromised credentials. A local attacker with user privileges could exploit this information disclosure to gain unauthorized access to Weblate instances across multiple servers. A patch is available in version 1.17.0 and later.
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. [CVSS 2.5 LOW]