Skip to main content

Weblate CVE-2025-58352

LOW
Insufficient Session Expiration (CWE-613)
2025-09-05 security-advisories@github.com
Information Disclosure Weblate
2.1
CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:10 vuln.today
Patch released
Mar 28, 2026 - 19:10 nvd
Patch available
CVE Published
Sep 05, 2025 - 00:15 nvd
LOW 2.1

DescriptionGitHub Advisory

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.

AnalysisAI

Weblate is a web based localization tool. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-613. Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1. Affected products include: Weblate. Version information: version 5.13.1..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Weblate

View all
CVE-2025-61587 MEDIUM POC
6.1 Oct 01

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
CVE-2026-34393 HIGH
8.8 Apr 15

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limi
CVE-2022-23915 HIGH
8.8 Mar 04

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
CVE-2026-33435 HIGH
8.0 Apr 15

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial

CVE-2026-34242 HIGH
7.7 Apr 15

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded f
CVE-2026-21889 HIGH
7.5 Jan 14

Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
CVE-2026-33220 MEDIUM
6.8 Apr 15

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo
CVE-2026-24126 MEDIUM
6.6 Feb 19

Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
CVE-2025-32021 LOW POC
2.2 Apr 15

Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
CVE-2026-50127 MEDIUM
5.9 Jun 10

Server-Side Request Forgery in Weblate's VCS_RESTRICT_PRIVATE control (versions 5.15 through pre-2026.6) allows bypassin
CVE-2017-5537 MEDIUM
5.3 Mar 15

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email addres
CVE-2024-39303 MEDIUM
5.4 Jul 01

Weblate is a web based localization tool. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,

Same weakness CWE-613 – Insufficient Session Expiration

View all
CVE-2022-36179 CRITICAL POC
9.8
CVE-2026-26342 CRITICAL POC
9.8
CVE-2016-5069 CRITICAL POC
9.8
CVE-2024-29401 CRITICAL POC
9.8
CVE-2023-49091 CRITICAL POC
9.8
CVE-2023-5865 CRITICAL POC
9.8
CVE-2023-5838 CRITICAL POC
9.8
CVE-2023-1854 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2025-58352 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy