CVE-2026-22250

wlc can skip SSL verification

State: Published
Severity: 2.5 Low
Published: Jan 12, 2026
Updated: Jan 12, 2026
Reserved: Jan 7, 2026

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Scores

CVSS	Score	Vector	Source
3.1	2.5 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
wlcWeblateOrg	< 1.17.0Affected

References

https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh
https://github.com/WeblateOrg/wlc/pull/1097
https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.