When receiving part of Xfer chat message, the Xfer plugin builds a partial buffer until the end of message is found.
There is no limit for the allocated buffer.
A malicious client sending large amount of data without end of message can lead to memory exhaustion and the WeeChat process can be killed by the OOM killer.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-15: [Xfer] Write of DCC file received outside of configured download path.
When receiving a DCC file, the filename may contain directory separator that is not the platform-native one (for example "/" received on Windows or "\" received on Linux). This separator may be interpreted as a directory separator, so the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.
Credit
The issue was discovered by Acts1631.
WSA-2026-6: [Xfer] Write of DCC file received outside of configured download path.
When receiving a DCC file, the filename built contains the remote nick (the option xfer.file.use_nick_in_filename is on by default).
If the nick contains special characters, the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Turn off option to include nick in filename: /set xfer.file.use_nick_in_filename off.
Credit
The issue was discovered by aizu-m.
WSA-2011-1: [IRC] Possible man-in-the-middle attack in TLS connection to IRC server.