Weblate CVE-2026-41654
MEDIUM
GHSA-cwcx-382v-8m9g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
Impact
An authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False).
Patches
- https://github.com/WeblateOrg/weblate/pull/19061
- https://github.com/WeblateOrg/weblate/pull/19062
Workarounds
Limiting who can create projects limits the scope.
Resources
Weblate thanks @fg0x0 for reporting this vulnerability via GitHub.
AnalysisAI
Authenticated Server-Side Request Forgery (SSRF) in Weblate before 5.17.1 allows users with project.add permission to import crafted project backup ZIPs containing malicious repository URLs pointing to private addresses or using non-allowlisted schemes (file://, git://) that bypass URL validation. The vulnerability exists because bulk_create() circumvents Django's full_clean() validator; attackers can write arbitrary URLs into .git/config, enabling SSRF attacks against internal systems or protocol exploitation.
Technical ContextAI
Weblate's project backup import mechanism deserializes component metadata from ZIP archives without revalidating repository URLs during restoration. The vulnerability stems from CWE-20 (Improper Input Validation). When a component is persisted via Component.objects.bulk_create([component])[0], Django's full_clean() method is bypassed, so the validate_repo_url validator never executes. This validator normally enforces an allowlist of schemes (http, https, git+https, ssh) and blocks private/internal IP ranges (127.0.0.1, 169.254.x.x, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). The attacker-controlled URL is subsequently written verbatim into the Git configuration file (.git/config) by configure_repo(pull=False), where it can be accessed by the application or command-line Git operations, enabling SSRF or protocol-based attacks.
RemediationAI
Upgrade to Weblate 5.17.1 or later immediately, which includes patches from PR 19061 and 19062 that add validate_component_urls() calls during backup restoration. This method revalidates both 'repo' and 'push' URL fields against the validate_repo_url validator before import, preventing malicious URLs from being written to .git/config. For deployments unable to upgrade immediately, the primary compensating control is to restrict the project.add permission to trusted administrators only. On Weblate SaaS, this requires administrative intervention to revoke the permission from non-admin users. Remove or disable backup import functionality if not actively required. Monitor backup imports for unusual repository URLs (especially file://, git://, or private IP ranges like 127.0.0.1, 10.x.x.x, 192.168.x.x). Implement network egress filtering to prevent Git operations from accessing private address ranges or non-standard ports on internal systems.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: HighShare
External POC / Exploit Code
Leaving vuln.today