EUVD-2026-66718Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible web app, low complexity; PR:L because exploitation requires the 'Edit source' role; pure availability impact with no confidentiality or integrity exposure.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. Regular expressions supplied through the regex: quality check and regex placeholders are compiled during validation but later run against translation content in RegexCheck and PlaceholderCheck with no time limit, so a catastrophic-backtracking pattern like ^(a|aa)+$ can consume CPU indefinitely. Because Weblate re-runs these checks for every linked target unit in the same request when a source unit's flags change, a single edit can trigger sustained CPU-bound denial of service. This issue is fixed in version 2026.7.
AnalysisAI
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'Edit source' role to induce sustained CPU exhaustion by storing a catastrophically-backtracking pattern in a source string's quality-check flags. Both the RegexCheck and PlaceholderCheck mechanisms compile user-supplied expressions at validation time but execute them without any runtime timeout, so a single malicious flag edit can pin server CPU indefinitely by re-triggering evaluation across every linked translation unit in the same request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Weblate account with the built-in 'Edit source' role, which grants write access to source string flags. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and score of 6.5 accurately captures the threat profile: network-accessible, low complexity, but gated on a low-privilege role with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Weblate contributor holding the 'Edit source' role submits a source string flag such as 'regex:^(a|aa)+$' targeting a source string linked to dozens or hundreds of translated languages. On saving, Weblate synchronously re-evaluates the regex check against every linked target unit in the same HTTP request, triggering exponential backtracking for each unit and pinning one or more server CPU cores. … |
| Remediation | Upgrade to Weblate 2026.7, which introduces regex execution timeouts in RegexCheck and PlaceholderCheck via new wrapper functions in weblate/utils/regex.py; the fix is confirmed in commit 8fd8431414bec5c86dbc94815319fc474518286a and detailed in the vendor advisory at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-r52j-4vjp-q949. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter o
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow
We need to produce a JSON object for CVE-2026-33435 based on all provided intelligence. The user gave description, CVSS,
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202
Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation
Weblate versions up to 5.16.0 contains a vulnerability that allows attackers to an argument injection to `ssh-add` (CVSS
Weblate is a web based localization tool. Rated low severity (CVSS 2.2), this vulnerability is remotely exploitable. Pub
Server-Side Request Forgery in Weblate's VCS_RESTRICT_PRIVATE control (versions 5.15 through pre-2026.6) allows bypassin
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today