What is the CVSS score of EUVD-2026-23001?

EUVD-2026-23001 has a contested CVSS base score of 8.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-23001?

Yes, a patch is available for EUVD-2026-23001. Update the affected software to the latest version immediately.

Weblate EUVD-2026-23001

| CVE-2026-33435 HIGH

Relative Path Traversal (CWE-23)

2026-04-15 GitHub_M

GHSA-558g-h753-6m33

RCE Weblate Weblateorg

High

Disputed · 8.0 NVD

Severity by source

Sources disagree (Low–High)

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 15:22 vuln.today

Analysis Generated

Jul 26, 2026 - 15:22 vuln.today

Patch released

Apr 21, 2026 - 14:10 nvd

Patch available

Apr 16, 2026 - 05:29 EUVD

5.17

CVSS changed

Apr 15, 2026 - 19:22 NVD

8.1 (HIGH) 8.0 (HIGH)

EUVD ID Assigned

Apr 15, 2026 - 18:45 euvd

EUVD-2026-23001

CVE Published

Apr 15, 2026 - 18:13 nvd

HIGH 8.0

DescriptionGitHub Advisory

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

AnalysisAI

We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS, CWE, EPSS, patch status, tags, CPE, SSVC, references, etc. We must synthesize all into the specified fields.

Let's extract key information:

Product: Weblate (web based localization tool)
Vulnerability: In versions prior to 5.17, project backup didn't filter Git and Mercurial configuration files, leading to remote code execution under certain circumstances. Fixed in 5.17.
CVSS 3.1: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (8.0)
CWE: CWE-23 (Relative Path Traversal) – but actually from description it's about unsafe inclusion of VCS config files (lack of sanitization of uploaded backup containing .git/config, hooks, etc.). The fix adds filtering of those paths. So it's more an issue of untrusted data used in backup restoration leading to RCE. CWE-23 might be a misclassification; but we'll incorporate the CWE provided.
EPSS: 0.33% (56th percentile) – relatively low exploitation probability.
SSVC: Exploitation: none, Automatable: no, Technical Impact: total. So no active exploitation, not automatable, total impact. This would prioritize moderately (in SSVC, if exploitation is none, but tech impact total, may still be "attend" but more a "scheduled").
Tags: RCE, Weblate
CPE: cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:* (all versions)
Affected versions: weblate < 5.17
Patch: Available from vendor, fixed in version 5.17. PR #18549 available.
References: GitHub advisory, PR diff.
Exploit status: No mention of KEV, so not KEV. No public exploit identified. From advisory: reported via HackerOne, but no indication of public exploit or active exploitation. So "no public exploit identified at time of analysis".
EPSS low, so unlikely widespread exploitation.
CVSS vector indicates AV:N (network), AC:H (high complexity), PR:H (privileges required high), UI:N (no user interaction), S:C (scope changed), C/H, I/H, A/H. This means a high-privi