EUVD-2026-66716Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Project-administrator authentication required (PR:L); network-accessible ZIP endpoint (AV:N); scope change justified by cross-repository host-file read (S:C); read-only impact with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.
AnalysisAI
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold project-administrator privileges on the target Weblate instance - this is an authenticated role above general registered users, typically assigned to translation project maintainers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-high for Weblate deployments where project-administrator roles are granted to partially trusted or external contributors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding project-administrator credentials on a target Weblate instance creates an App store component and places a symbolic link within the repository - for example, symlinking translations/credentials.txt to /etc/weblate/settings.py or ~/.ssh/id_rsa on the host. The attacker then calls the monolingual base ZIP download API endpoint for that component; the unpatched Weblate follows the symlink and packages the host file's contents into the returned ZIP archive. … |
| Remediation | The primary remediation is upgrading to Weblate 2026.7 or later, which resolves the symlink traversal by adding explicit symlink-target validation in the zip_download utility, ensuring symlinks pointing outside the repository root are excluded from archives. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Weblate deployments and identify instances running versions prior to 2026.7. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E
Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
Server-Side Request Forgery in Weblate's VCS_RESTRICT_PRIVATE control (versions 5.15 through pre-2026.6) allows bypassin
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today