WeeChat :: documentation

WeeChat

Overview: 1 vulnerability

WSA	Score	Severity	Issue	Vulnerability type	Scope	Versions	Fix	Release date
WSA-2026-11	9.3		Write of logger file outside of configured path.	Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal")	Logger	0.3.0 → 4.9.3	4.9.4	Jul 19, 2026

WSA-2026-11: [Logger] Write of logger file outside of configured path.

Vulnerability

CVE

Not available

CVSS vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H (detail)

CVSS score

9.3 / 10

Severity

critical

Vulnerability type

Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") (detail)

Scope

Logger

Affected versions

0.3.0 → 4.9.3

Fixed version

4.9.4 (Jul 19, 2026) - ChangeLog

Tracker

issue #2340

Commits

Description

When writing a log file, a specific char used internally as separator may be used to forge a new path that can be outside the path configured by the option logger.file.path.

Mitigation

There is no known mitigation.
The upgrade to the latest stable version is highly recommended.

Credit

The issue was discovered by Mohammed Arib.