Nixpkgs security tracker

Untriaged

Permalink CVE-2026-23535

8.1 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 3 months ago

wlc Path traversal: Unsanitized API slugs in download command

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.

References

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-mmwx-79f6-67jg x_refsource_CONFIRM
https://github.com/WeblateOrg/wlc/pull/1128 x_refsource_MISC
https://github.com/WeblateOrg/wlc/commit/216e691c6e50abae97fe2e4e4f21501bf49a585f x_refsource_MISC
https://github.com/WeblateOrg/wlc/releases/tag/1.17.2 x_refsource_MISC

Affected products

wlc

==< 1.17.2

Matching in nixpkgs

pkgs.wlc

Weblate commandline client using Weblate's REST API

nixos-unstable 1.15
- nixpkgs-unstable 1.15
- nixos-unstable-small 1.15
nixos-25.11 1.16.1
- nixpkgs-25.11-darwin 1.16.1

pkgs.wlcs

Wayland Conformance Test Suite

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0
nixos-25.11 1.8.1
- nixpkgs-25.11-darwin 1.8.1

pkgs.wlclock

Digital analog clock for Wayland desktops

nixos-unstable 1.0.1
- nixpkgs-unstable 1.0.1
- nixos-unstable-small 1.0.1
nixos-25.11 1.0.1
- nixpkgs-25.11-darwin 1.0.1

pkgs.imewlconverter

FOSS program for converting IME dictionaries

nixos-unstable 3.2.0
- nixpkgs-unstable 3.2.0
- nixos-unstable-small 3.2.0
nixos-25.11 3.3.0
- nixpkgs-25.11-darwin 3.3.0

Package maintainers

@xddxdd Yuhui Xu <b980120@hotmail.com>
@paperdigits Mica Semrick <mica@silentumbrella.com>
@NomisIV Simon Gutgesell <simon@nomisiv.com>
@OPNA2608 Cosima Neidahl <opna2608@protonmail.com>

Suggestion detail