Security vulnerabilities in version 4.9.3
This page lists all known and fixed security vulnerabilities in version 4.9.3 (back to the list of all versions ).
Overview: 2 vulnerabilities
WSA Score
Severity
Issue
Vulnerability type
Scope
Versions Fix Release date
WSA-2026-11 9.3
Write of logger file outside of configured path.
Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal")
Logger
0.3.0 → 4.9.3
4.9.4
Jul 19, 2026
WSA-2026-10 10.0
Authentication bypass in Relay plugin, protocols "api" and "weechat".
Authentication Bypass Using an Alternate Path or Channel
Relay
4.3.0 → 4.9.3
4.9.4
Jul 19, 2026
WSA-2026-11 : [Logger] Write of logger file outside of configured path.
Vulnerability
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
(
detail )
Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal")
(
detail )
Affected versions
0.3.0 → 4.9.3
Description
When writing a log file, a specific char used internally as separator may be used to forge a new path that can be outside the path configured by the option
logger.file.path.
Mitigation
There is no known mitigation.
The upgrade to the latest stable version is highly recommended.
Credit
The issue was discovered by Mohammed Arib.
WSA-2026-10 : [Relay] Authentication bypass in Relay plugin, protocols "api" and "weechat".
Vulnerability
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
(
detail )
Authentication Bypass Using an Alternate Path or Channel
(
detail )
Affected versions
4.3.0 → 4.9.3
Description
A malicious client could authenticate on the relay, with protocol "api" or "weechat", without giving the password configured in WeeChat.
Mitigation
There are multiple ways to mitigate this issue:
Remove all relays with protocol "api" or "weechat", see: /help relay
Unload relay plugin with command: /plugin unload relay and see: /help weechat.plugin.autoload
Secure relay to allow only trusted IP addresses, see: /help relay.network.allowed_ips
Credit
The issue was discovered by Mohammed Arib.