Weblate CVE-2026-33435

Exploitation requires: (1) an account with Weblate's 'can create projects' permission, which is typically restricted to administrators or trusted maintainers; (2) the ability to upload or trigger a project backup restore, accessible only through the project backup interface available to project-creation-privileged users; (3) post-restore execution of a git operation on the affected component to trigger the planted hook - this occurs automatically as Weblate syncs repositories but is not instant. Limiting factors: the attacker must already hold elevated Weblate privileges (PR:H), the hook execution is deferred until git operations run (AC:H), and the attack is not automatable (SSVC: Automatable no). Default Weblate installations where project-creation rights are tightly controlled are at low practical risk.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (8.0) reflects the privilege barrier accurately: only users with project-creation rights can upload and restore backups, placing the realistic attacker profile at a high privilege tier. AC:H captures the 'certain circumstances' qualifier - hooks must be triggered by subsequent VCS operations on the restored component, which is not instantaneous. The Scope:Changed metric is appropriate because successful exploitation escapes the Weblate web process and executes code at the OS level. SSVC signals Exploitation: none and Automatable: no, consistent with the EPSS of 0.33% (56th percentile) - exploitation requires a chain of deliberate steps. The Technical Impact is rated 'total' by SSVC due to full RCE. Overall this is a credible but access-gated threat: real-world risk is bounded by the requirement to hold project-creation privileges, which in most deployments is a small, trusted user population. Priority is medium unless the Weblate instance grants project-creation rights broadly.

An authenticated Weblate user with project-creation privileges crafts a malicious project backup ZIP containing a vcs/<component>/.git/hooks/post-checkout shell script alongside legitimate translation data. After uploading and triggering restore, Weblate extracts the archive without filtering VCS paths, planting the hook on the server filesystem. The next time Weblate's git integration performs a checkout on that component (e.g., during translation sync), the hook script executes as the Weblate server process, granting the attacker OS-level code execution.