EUVD-2026-23000
GHSA-mqph-7h49-hqfm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Requires authenticated user and user interaction; high confidentiality via scope change.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.
AnalysisAI
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Technical ContextAI
CVE-2026-33220 is a path traversal vulnerability (CWE-22) affecting Weblate, a web-based localization tool. The issue lies in the translation memory API, which exposes endpoints that lack proper access control. Attackers can craft file paths containing directory traversal sequences (e.g., '../../etc/hosts') to read sensitive files outside the intended repository directory. The CPE string cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:* identifies all versions of Weblate as potentially affected prior to the fix. The fix adds validation for filenames using validate_filename and restricts remote URL downloads via ALLOWED_ASSET_DOMAINS, as seen in the pull request (https://github.com/WeblateOrg/weblate/pull/18516).
RemediationAI
Upgrade to Weblate version 5.17 or later, which includes validation fixes to prevent path traversal and restrict remote URL domains (see pull request https://github.com/WeblateOrg/weblate/pull/18516). As a workaround, ensure the CDN add-on (addon-weblate.cdn.cdnjs) is not enabled unless required, since it is not default and exposes the vulnerable endpoints. If the translation memory API is not needed, consider disabling it or restricting access to authenticated users with higher privileges. Note that disabling the CDN add-on may affect localization workflows that rely on remote translations.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today