CVE-2026-22250
LOW2.5EPSS 0.01%Weblate command-line client susceptible to SSL verification skip
發布日:2026/1/12修改日:2026/2/3
描述
### Impact The SSL verification would be skipped for some crafted URLs. ### Patches * https://github.com/WeblateOrg/wlc/pull/1097 ### Workarounds Avoid using untrusted wlc configurations, as that might cause insecure connections. ### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.
受影響套件(2)
- Debian/wlcfrom 0
- PyPI/wlcfrom 0, < 1.17.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW2.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N |
參考連結(6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-22250
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-22250
- PATCHhttps://github.com/WeblateOrg/wlc
- WEBhttps://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3
- WEBhttps://github.com/WeblateOrg/wlc/pull/1097
- WEBhttps://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh