Weblate CVE-2025-61587

Exploitation requires a specific non-default deployment: Weblate configured with Anubis as the bot/anti-abuse layer AND the REDIRECT_DOMAINS setting left unset, which allows the redir parameter on the .within.website path to redirect to arbitrary external domains. The commit evidence confirms the fix is to set REDIRECT_DOMAINS (matching WEBLATE_SITE_DOMAIN) and to qualify the nginx redir value with $scheme://$host. Exploitation is further limited by required victim interaction - the target must actively click an attacker-crafted link (CVSS UI:A) - and the attack is unauthenticated (PR:N) but yields no impact to the Weblate system itself, only to the redirected end user. Installations without Anubis, or with REDIRECT_DOMAINS configured, are not affected.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The vendor CVSS 4.0 vector scores only 2.1, driven down by AT:P (a specific attack requirement - the vulnerable Anubis/REDIRECT_DOMAINS misconfiguration must be present) and UI:A (the victim must actively click a crafted link). Vulnerable-system impact is explicitly none (VC:N/VI:N/VA:N); only subsequent-system confidentiality and integrity are rated low (SC:L/SI:L), consistent with CWE-601 open redirect where harm lands on the user's browser, not the Weblate host. EPSS reinforces low risk at 0.04% (12th percentile). This is NOT on CISA KEV, so there is no evidence of active exploitation. A public exploit reference does exist (the GitHub security advisory GHSA-3xhv-r4gx-xw99), but POC availability must not be conflated with active exploitation - open-redirect PoCs are trivial to construct regardless. The one caveat worth stating: the flaw only exists in a specific deployment mode (Anubis enabled with REDIRECT_DOMAINS unset), so raw CVSS already accounts for this via AT:P - default Weblate installs are not affected. Net: a real but low-severity phishing/redirect aid, not an urgent patch priority.

An attacker crafts a URL on the organization's legitimate Weblate domain containing a malicious redir parameter on the .within.website path, then delivers it via phishing. Because CVSS shows UI:A, the victim must click the link; they are then silently redirected to an attacker-controlled site that may serve a phishing page or trigger a drive-by download of a malicious file. A public reference exploit exists in the GitHub advisory, though no active exploitation is recorded in CISA KEV.