low2.5
CVE-2026-22250
Weblate command-line client susceptible to SSL verification skip
Impact
### Impact The SSL verification would be skipped for some crafted URLs. ### Patches * https://github.com/WeblateOrg/wlc/pull/1097 ### Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. ### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | wlc | < 1.17.0 | 1.17.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Weblate | Wlc | before 1.17.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3
- https://github.com/WeblateOrg/wlc/pull/1097
- https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh
- https://github.com/advisories/GHSA-2mmv-7rrp-g8xh
- https://nvd.nist.gov/vuln/detail/CVE-2026-22250