Weblate CVE-2026-34244

We need to produce a JSON object with all the specified fields, based on the provided CVE data.

Let's extract relevant info:

CVE ID: CVE-2026-34244 Description: Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.

CVSS Score: 5.0, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CWE: CWE-200 (Information Exposure)

Multi-source: EPSS Score: 0.03% (percentile 7%) → low exploitation probability Patch: Available from vendor (version 5.17) Reported by: GitHub_M CPE: cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:* Tags: Information Disclosure, SSRF, Weblate SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD: EUVD-2026-23004, affected versions: weblate < 517 (which is 5.17? "517" likely means 5.17, since version numbers sometimes notation like "517" or "5.17". In the patch references, they refer to "Weblate 5.17". So affected: <5.17. References: GitHub security advisory GHSA-xrwr-fcw6-fmq8; commit e619e909...; pull request #18684. Source code evidence from GitHub advisory and commit diff shows the addition of ALLOWED_MACHINERY_DOMAINS setting, blocking private-network targets for untrusted endpoints, and hiding error details from untrusted remote providers. The test shows blocking a private IP target (127.0.0.1) with error "URL domain is not allowed."

Important: The vulnerability requires authenticated user with project.edit permission (Administration role) and specific ability to configure machine translation service URLs. So the attacker needs valid low-privilege? The CVSS vector says PR:L (low privileges). So the attacker needs a user account with project Administration role (which grants project.edit permission). The attack allows SSRF with limited response read (200 chars) to internal addresses. The configuration validation makes request to URL and reflects part of response body in error message.

Now we need to produce a comprehensive analysis. Fields:

1. product_name: "Weblate" — only product name, so "Weblate". Could also be "Weblate translation tool" but keep short: "Weblate". I'll go with "Weblate".
2. summary: Not a paraphrase. Start with impact: "Information disclosure via SSRF in Weblate prior to 5.17 allows authenticated project administrators to read partial internal network responses." Mention KEV: No KEV, no active exploitation. EPSS low. POC? Not mentioned, but the advisory details the vulnerability; however, no explicit POC script. So: "no public exploit identified at time of analysis." So combine: "Server-side request forgery (SSRF) with limited response disclosure in Weblate versions before 5.17 permits an authenticated user with the Administration role to probe internal services and read up to 200 characters of response data." And mention EPSS, etc. So: "An authenticated user with the project.edit permission (project Administration role) can configure machine translation URLs pointing to internal addresses; the validation request reflects partial response data in an error message. This allows internal service fingerprinting, with no code execution or privilege escalation. No active exploitation reported, and EPSS indicates low probability."
3. technical_context: "Underlying technology: Weblate's machinery configuration allows users to specify third-party machine translation services, which the application calls to validate endpoints. The vulnerability arises from insufficient validation of these URLs, enabling SSRF to internal hosts. CWE-200 (Information Exposure) because the response body is leaked partially. The fix introduces ALLOWED_MACHINERY_DOMAINS and blocks private-IP targets for project-level configuration. CPE: cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:* covers all versions before 5.17."
4. risk_assessment: CVSS 5.0, vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS 0.03% (very low). SSVC: none exploitation, not automatable, partial impact. KEV not listed. So overall risk low. Need to compare: CVSS medium severity but low exploitability in the wild. "CVSS score of 5.0 suggests moderate impact with low confidentiality loss across a scope change; however, EPSS 0.03% indicates negligible exploitation activity. The vulnerability requires authenticated project-level access, limiting real-world risk. Active exploitation not observed (no KEV)."
5. affected_products: "Weblate versions prior to 5.17 (all releases before 5.17). This includes any Weblate instance where users can be granted project Administration role. The official vendor advisory is at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8. CPE: cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:*."
6. remediation: "Upgrade to Weblate 5.17 or later, where the SSRF is fixed by blocking private-network destinations and hiding untrusted error details. The fix also introduces ALLOWED_MACHINERY_DOMAINS to explicitly whitelist permitted external services. If immediate upgrade is not possible, restrict available machinery services using the WEBLATE_MACHINERY setting to only trusted services, eliminating the ability to configure arbitrary URLs. Additionally, consider network segmentation to limit outbound connections from the Weblate server to internal networks. Refer to advisory GHSA-xrwr-fcw6-fmq8 and commit e619e9090202e4886b844c110d39308e7e882c0e."
7. exploit_scenario: "An attacker with Administration role on a Weblate project configures a machine translation service URL pointing to an internal metadata service (e.g., http://169.254.169.254/) and triggers validation; the error message returns up to 200 characters of the response, potentially leaking cloud instance credentials or internal configuration data." No POC publicly known? The advisory doesn't mention POC; we say no public exploit identified. So "No public exploit code exists, but the steps are straightforward for an authenticated user."
8. exploitation_conditions: "The attacker must have an account on the Weblate instance with the per-project Administration role (project.edit permission) and access to the project configuration interface to specify a machine translation service URL. The vulnerability is exploitable only against Weblate versions prior to 5.17 and requires that the instance allows outbound HTTP connections to user-supplied endpoints. There is no default exposure: an attacker must be specifically granted project Administration privileges." So conditions are: authenticated with project.edit permission, ability to set machinery URL. So PR:L. Access: network if the Weblate web interface is accessible. So conditions: "Requires authenticated user with project Administration role. Exploitation further depends on unpatched version (<5.17) and ability to configure machinery services for a project."
9. attack_chain: "Authenticate as project administrator → Access project machinery settings → Configure service URL to internal target → Trigger validation which sends HTTP request to internal host → Error message reflects partial response body → Exfiltrate data or probe internal services." Possibly 5-6 steps. Use kill chain phases: Recon (identify Weblate instance and obtain credentials), Delivery/Exploit: use project admin interface, Exploit: set URL, Execution: validation request, Impact: read response. So: "Obtain project Administration credentials → Access machinery configuration endpoint → Set custom service URL targeting internal host → Submit configuration to trigger validation → Weblate makes HTTP request to internal address → Error response returns truncated body → Attacker reads sensitive internal information." That works.
10. confidence_notes: "Vendor patch confirmed via advisory GHSA-xrwr-fcw6-fmq8 and commit e619e909. No evidence of active exploitation; EPSS low. Exploit prerequisites (authenticated project admin) are explicit in advisory. Patch version 5.17 verified." So: "Fix version 5.17 confirmed by Weblate maintainers. Exploitation prerequisites (authenticated project administrator) confirmed by advisory. No public exploit code or indicators of in-the-wild exploitation observed." So confidence high.
11. prevalence: How widely deployed is Weblate? It's a web-based localization tool used for open-source projects, but not as widespread as major web servers. I'd estimate medium: "medium". Because it's a known tool in the localization space, not universal. Basis: "popular open-source translation management platform, but not ubiquitous." Or "niche but widely adopted in open-source communities." I'd go with medium. prevalence: "medium". prevalence_basis: "popular in open-source translation projects but not enterprise-ubiquitous."
12. assessed_cvss_vector: We need to provide an independent assessment. The official CVSS is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. That seems accurate. But I'll re-assess: Attack vector: Network, Attack complexity: Low, Privileges required: Low (authenticated, but user needs specific role - but PR:L is fine), User interaction: None, Scope: Changed (the vulnerable component is Weblate, and the impacted component is the internal service), Confidentiality: Low (partial read of response), Integrity: None, Availability: None. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. That matches. I'll output that. Rationale: "Authenticated project administrator can trigger SSRF to internal networks, leaking limited data; no integrity or availability impact."
13. assessed_cvss40_vector: Need to map to CVSS 4.0. The base metrics: AV:N (Network), AC:L (Low), AT:N (Attack Requirements: None?), PR:L (Low), UI:N (None), VC:L/VI:N/VA:N? In CVSS 4.0, we have vulnerable system impact (VC, VI, VA) and subsequent system impact (SC, SI, SA). The scope change indicates that the vulnerable component (Weblate) affects a different component (internal service). But in CVSS 4.0, scope change is handled by different metrics: the vulnerable system is Weblate, the subsequent system is the internal service. According to the CVSS 4.0 spec, for a vulnerability with a scope change, we set: VC, VI, VA for the vulnerable component, and SC, SI, SA for the subsequent system. Here, the vulnerability impacts the internal service (confidentiality loss) but not Weblate directly. Actually, the attacker exploits Weblate to affect the internal service. In CVSS 3.1, S:C indicates that a vulnerability in a vulnerable component can impact a different component, and the impact metrics (C/I/A) refer to the impacted component. So in 4.0, we need to separate impacts: Typically, the vulnerable system might have some confidentiality impact? The advisory mentions that the response is reflected in an error message shown to the user, so there is some information disclosure from the internal service. The vulnerability is SSRF, so the confidentiality impact is on the internal service. The Weblate itself might not be impacted. So we can set VC:N, VI:N, VA:N (no direct impact on Weblate), and SC:L, SI:N, SA:N (confidentiality loss on the subsequent system). The CVSS 4.0 vector would be: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N. That seems correct. Rationale: "Privileged user triggers request to internal service; no direct impact on Weblate, but subsequent system confidentiality breached (partial)." I'll include assessed_cvss40_rationale? The field is "assessed_cvss40_vector" just vector output, not rationale. The user request says: "assessed_cvss40_vector": "The SAME assessment expressed as a CVSS 4.0 base vector..." So just vector. I'll output that.

Now compose JSON fields accordingly. Ensure all are plain strings.