EUVD-2026-23018
GHSA-f8hv-g549-hwg2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
High privilege required to configure webhook; SSRF only affects confidentiality of internal services.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.
AnalysisAI
Server-side request forgery in Weblate's webhook add-on allows high-privileged users to bypass existing SSRF protections and make requests to internal network resources. Versions prior to 5.17 are affected; the fix introduces a new restriction setting that blocks private IP ranges by default. No active exploitation is reported (EPSS 0.01%, no CISA KEV entry), and no public exploit code has been identified at this time.
Technical ContextAI
Weblate is a Django-based web localization tool that supports add-ons, including a webhook add-on that sends HTTP requests to user-configured URLs upon translation events. The vulnerability (CWE-918, Server-Side Request Forgery) arises because the add-on's fetch_url() function did not apply the existing SSRF protection mechanisms that were already used elsewhere in the platform (e.g., for project URLs). The CPE cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:* identifies the affected product. The fix in version 5.17 introduces the WEBHOOK_RESTRICT_PRIVATE setting (enabled by default) and a complementary allowlist (WEBHOOK_PRIVATE_ALLOWLIST), ensuring that outbound webhook URLs are validated against private and non-global IP ranges.
RemediationAI
Upgrade to Weblate version 5.17, which enforces the new WEBHOOK_RESTRICT_PRIVATE setting (enabled by default) that blocks webhook URLs pointing to private or non-global IP ranges unless explicitly allowed via WEBHOOK_PRIVATE_ALLOWLIST. The fix is implemented in pull request https://github.com/WeblateOrg/weblate/pull/18815. If immediate upgrading is not possible, disabling the webhook add-on entirely through the Weblate administration interface will eliminate the attack vector.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today