The wlc command‑line client for Weblate is vulnerable to a path‑traversal flaw in its multi‑translation download feature. Unsanitized API slugs supplied by the server cause the client to write files to any location specified in the response. The weakness is documented as CWE‑22 and results in arbitrary file write on the local file system.

The affected product is WeblateOrg's wlc client. All releases prior to version 1.17.2 are vulnerable. The fix is delivered in release 1.17.2 and later. Any installation that uses the multi‑translation download capability to communicate with a Weblate server is susceptible until the client is updated.

The base CVSS score is 8.1, indicating a high‑severity flaw that can be exercised during normal client operation. The EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a server that sends a crafted API response instructing the client to write to an arbitrary path; the client must have write permission to that path. If the client runs with elevated privileges, overwriting executable or configuration files could potentially lead to broader compromise.