🎯 New Report #3887969: SSRF via URL Parser Differential in `normalize request url` (wlc)
🔺Severity: High
👽 Reporter: dark river
⭐️ Reputation: 179
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-24
⏰ Disclosed: 2026-09-02 07:49:35
📝 Summary: The Weblate CLI client (wlc) was found to be vulnerable to Server-Side Request Forgery (SSRF) due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalize request url function, which was meant to validate that outgoing API requests stayed on the configured server's origin. However, the actual HTTP request was dispatched by the requests library, which relied on urllib3's URL parser. This allowed an attacker-controlled server to return a crafted URL that passed the origin validation but resulted in the client making a request to an arbitrary host.
📂 Report JSON File: 3887969
@hackeronereports