Weblate CVE-2026-61792

Exploitation requires the attacker to hold project-administrator privileges on the target Weblate instance - this is an authenticated role above general registered users, typically assigned to translation project maintainers. The target instance must have at least one App store (appstore) component type configured, as the vulnerability is specific to the appstore monolingual base ZIP download feature and not present in all component types. The attacker must have write access to repository storage in order to create symbolic links within the repository directory. The Weblate server process must have filesystem read access to the target file for the traversal to yield content. Exploitation is bounded by: (1) the mandatory project-administrator role - unauthenticated or standard authenticated users cannot trigger the vulnerable endpoint; (2) the appstore component type must be actively used; (3) the attacker must control repository file creation, not merely translation string content; and (4) disclosed files are limited to those readable by the OS user running Weblate.

Real-world risk is moderate-to-high for Weblate deployments where project-administrator roles are granted to partially trusted or external contributors. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H) accurately reflects the attack profile: network-reachable, low complexity, authenticated low-privilege user, no user interaction required, with a scope change because the read escapes the repository boundary onto the broader host filesystem. The S:C designation is justified - host files such as SSH keys, database credentials, or application secrets outside the project repository can be read, amplifying impact well beyond a confined information disclosure. No EPSS score was provided in the source data, and the CVE is not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. The PR:L requirement (project administrator) is the primary real-world mitigating factor: opportunistic exploitation is impossible without first obtaining or compromising a project-admin account. For deployments where project-admin access is granted broadly - common in open-source projects using Weblate for community-contributed translations - the attack surface is meaningfully larger, and organizations with sensitive credentials co-located on the Weblate host should treat this as urgent.

An attacker holding project-administrator credentials on a target Weblate instance creates an App store component and places a symbolic link within the repository - for example, symlinking translations/credentials.txt to /etc/weblate/settings.py or ~/.ssh/id_rsa on the host. The attacker then calls the monolingual base ZIP download API endpoint for that component; the unpatched Weblate follows the symlink and packages the host file's contents into the returned ZIP archive. The attacker extracts the file from the download with no further tooling required. No public exploit code has been identified at time of analysis, but the technique requires only standard OS symlink creation and a single authenticated HTTP request.