---
id: CVE-2026-22250
aliases:
  - GHSA-2mmv-7rrp-g8xh
  - PYSEC-2026-2051
title: Weblate command-line client susceptible to SSL verification skip
summary: Weblate command-line client susceptible to SSL verification skip
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N'
vendor: wlc
product: wlc
ecosystem: pip
affected:
  - wlc < 1.17.0
patched:
  - wlc 1.17.0
published: '2026-01-12'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2mmv-7rrp-g8xh'
references:
  - url: 'https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22250'
  - url: 'https://github.com/WeblateOrg/wlc/pull/1097'
  - url: >-
      https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3
  - url: 'https://github.com/WeblateOrg/wlc'
tags:
  - osv
  - pip
epss: 0.00156
epssPercentile: 0.03968
ingestedAt: '2026-07-08T18:25:44.570Z'
---

## Overview

### Impact
The SSL verification would be skipped for some crafted URLs.

### Patches
* https://github.com/WeblateOrg/wlc/pull/1097

### Workarounds
Avoid using untrusted wlc configurations, as that might cause insecure connections.

### References
This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

## Affected packages

- `wlc < 1.17.0`

## Remediation

Upgrade to a patched release:

- `wlc 1.17.0`