EUVD-2026-23000
GHSA-mqph-7h49-hqfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Weblate
-
DeliveryCraft malicious path traversal string
-
ExploitSubmit to translation memory API
-
ExecutionBypass path validation
-
PersistRead arbitrary file outside repository
-
ImpactExfiltrate file contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid Weblate account with low privileges (PR:L) and user interaction (UI:R) - the attacker must convince a user (or themselves, if they have access to the translation memory interface) to submit a crafted request. The vulnerability is present in the translation memory API, which is exposed by default unless the CDN add-on is disabled. No special configuration beyond default setup is needed for exploitation, but the CVSS scope change indicates the attacker can access files on the host system (outside the application). Limits: the attacker must be authenticated (cannot be unauthenticated) and the victim must interact with the crafted request (e.g., clicking a link or submitting a form). The CDN add-on is not enabled by default, but the translation memory API itself may still be vulnerable in default installations. |
| Impact | The vulnerability has a CVSS 3.1 base score of 6.8 (Medium), with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N, indicating a network-exploitable issue requiring low-privileged authentication and user interaction, with high confidentiality impact due to scope change. However, other signals suggest very low real-world risk: the EPSS score is 0.04% (11th percentile), meaning a negligible probability of exploitation in the wild. The CISA SSVC evaluation reports no exploitation detected, and the vulnerability is not automatable. The technical impact is partial. The vulnerability is only exploitable when the translation memory API is accessible and when a user interacts with a crafted request. Since the CDN add-on is not enabled by default, the attack surface is reduced unless administrators have explicitly enabled this feature. Overall, this is a low-priority issue despite the medium CVSS score. |
| Exploit ScenarioDerived | An authenticated user with low privileges (e.g., a translator) submits a crafted request to the translation memory API containing a path traversal string like '../../../../etc/passwd' in the 'files' parameter. The vulnerable code then reads and returns the contents of the specified file outside the repository, allowing the attacker to exfiltrate sensitive system files. While a public proof-of-concept exploit is not confirmed, the technical details from the PR demonstrate the attack path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
RemediationAI
Upgrade to Weblate version 5.17 or later, which includes validation fixes to prevent path traversal and restrict remote URL domains (see pull request https://github.com/WeblateOrg/weblate/pull/18516). As a workaround, ensure the CDN add-on (addon-weblate.cdn.cdnjs) is not enabled unless required, since it is not default and exposes the vulnerable endpoints. If the translation memory API is not needed, consider disabling it or restricting access to authenticated users with higher privileges. Note that disabling the CDN add-on may affect localization workflows that rely on remote translations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-33220 is a path traversal vulnerability (CWE-22) affecting Weblate, a web-based localization tool. The issue lies in the translation memory API, which exposes endpoints that lack proper access control. Attackers can craft file paths containing directory traversal sequences (e.g., '../../etc/hosts') to read sensitive files outside the intended repository directory. The CPE string cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:* identifies all versions of Weblate as potentially affected prior to the fix. The fix adds validation for filenames using validate_filename and restricts remote URL downloads via ALLOWED_ASSET_DOMAINS, as seen in the pull request (https://github.com/WeblateOrg/weblate/pull/18516).
Know when Weblate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Requires authenticated user and user interaction; high confidentiality via scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Improper input validation in Weblate versions prior to 5.15.1 lets a user who can submit translation files or restore pr
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Argument injection in Weblate's Mercurial backend lets an authenticated user with project-scoped component.edit permissi
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticat
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Exploit-DB