{"id":"CVE-2026-22250","aliases":["GHSA-2mmv-7rrp-g8xh","PYSEC-2026-2051"],"title":"Weblate command-line client susceptible to SSL verification skip","summary":"Weblate command-line client susceptible to SSL verification skip","severity":"low","cvss":2.5,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","vendor":"wlc","product":"wlc","ecosystem":"pip","affected":["wlc < 1.17.0"],"patched":["wlc 1.17.0"],"published":"2026-01-12","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2mmv-7rrp-g8xh","references":[{"url":"https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22250"},{"url":"https://github.com/WeblateOrg/wlc/pull/1097"},{"url":"https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3"},{"url":"https://github.com/WeblateOrg/wlc"}],"tags":["osv","pip"],"epss":0.00156,"epssPercentile":0.05149,"ingestedAt":"2026-07-08T18:25:44.570Z","slug":"CVE-2026-22250","body":"## Overview\n\n### Impact\nThe SSL verification would be skipped for some crafted URLs.\n\n### Patches\n* https://github.com/WeblateOrg/wlc/pull/1097\n\n### Workarounds\nAvoid using untrusted wlc configurations, as that might cause insecure connections.\n\n### References\nThis issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.\n\n## Affected packages\n\n- `wlc < 1.17.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `wlc 1.17.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}