Weblate EUVD-2026-23003

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o

Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u

Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow

Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticat

The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t

Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202

Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli

Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation

Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS

Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E

Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub