Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:08 am   |   Path Traversal

A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metadata files, including working-copy databases and credential cache entries, to be included in downloaded archives when such directories were present in component trees. The issue represented a completeness failure in a security hardening mechanism introduced in a prior security fix, affecting multiple code paths including path validation, symlink resolution, backup operations, and component discovery.

wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Information Exposure Through an Error Message

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not found resulted in an uncaught exception that printed a full Python traceback to stderr instead of a user-friendly error message. The traceback exposed local absolute paths and internal package information. These issues affected both download and upload operations and were present in release 2.2.0 and the main development branch.

Translation discovery crashes on crafted filenames (regex substitution injection)

Bug reported by 0xsumit was disclosed at October 30, 2026, 5:07 am   |   Use of Externally-Controlled Format String

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex engine to raise errors. These uncaught exceptions terminated the entire discovery process for a repository. An attacker with commit access could exploit this to cause a denial of service by committing a single file with a specially crafted name. The vulnerability was fixed by passing wildcard replacements through a callback function instead of string interpolation.

Revoked deployment collaborator regains access to private comments after active collaborator interaction

Bug reported by Domingos Toko Muanda was disclosed at October 29, 2026, 8:25 am   |   Access Control Check Implemented After Asset is Accessed

A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and retrieve private deployment collaboration data, including comment threads and messages, without being re-invited or granted new authorization.