Weblate EUVD-2026-23018

Exploitation requires a Weblate administrator (or any user with permission to configure the webhook add-on) to supply a malicious webhook URL. The vulnerable condition is the default behavior in Weblate versions prior to 5.17, where the webhook add-on does not verify whether the target host resolves to a private IP range. Limiting factors: the attacker must have high privileges in the Weblate instance, and the webhook add-on must be enabled and configured with a custom URL.

The CVSS 3.1 base score is 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), indicating a low severity with a scope change. The high privilege requirement (PR:H) means only administrators with add-on configuration rights can exploit it. EPSS probability is 0.01% (very low), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. These signals consistently indicate a low real-world risk: the vulnerability is not trivial to exploit (privilege escalation) and has limited potential impact (confidentiality leakage from internal services). No conflicting signals exist; the risk is appropriately assessed as low.

An authenticated administrator with access to the Weblate add-on configuration can craft a malicious webhook URL pointing to an internal service (e.g., a cloud metadata endpoint at http://169.254.169.254/). When the webhook is triggered by a translation event, the Weblate server makes an HTTP GET request to that internal URL, potentially exposing sensitive information such as cloud instance credentials.