Weblate EUVD-2026-88976

Exploitation requires ALL of: (1) an authenticated user with project-scoped component.edit permission (PR:L, not unauthenticated); (2) the affected component must use the Mercurial VCS backend - Git-backed components are unaffected; (3) the component must be a RESX component using the 'Update RESX files' add-on, which is the vector for introducing an option-shaped (dash-prefixed) filename; (4) a subsequent repository update must occur to trigger the deferred command execution. These narrow prerequisites (specific VCS backend, specific file format, specific add-on, and delayed activation) are the AC:H limiting factors and substantially reduce the realistic attack surface versus the raw CVSS network vector. Applies to Weblate 4.11.1 through 2026.7.1; fixed in 2026.8.

This is a genuine but conditional priority, not an inflated high-CVSS score. The vendor CVSS of 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable argument-injection flaw in Weblate's Mercurial backend (CWE-78) that yields command execution as the Weblate service account - a full C:H/I:H/A:H technical impact with a scope change (S:C) because a project-scoped permission escalates to service-account code execution. Two signals temper this: AC:H and PR:L. Exploitation requires an authenticated user holding project-scoped component.edit permission AND a very specific setup (a Mercurial-backed RESX component using the 'Update RESX files' add-on), and execution is deferred until a later repository update - hence AC:H. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis.' The GitHub commit diff (f60a975) and PR #20768 concretely confirm the fix (adding '--' separators before filenames in hg commit and cat), which corroborates the vulnerability mechanism and the affected code path. Notably this is a residual incomplete fix for CVE-2022-23915, meaning the general vulnerability class was known and previously patched imperfectly - raising the plausibility that a knowledgeable attacker could reconstruct exploitation from the public diff. Net: medium-to-high priority for organizations running Mercurial-backed Weblate with the RESX add-on and untrusted users holding component.edit; lower for the many deployments using Git backends or trusting all component editors.

An authenticated Weblate user with project-scoped component.edit permission on a Mercurial-backed RESX component (configured with the 'Update RESX files' add-on) arranges for a repository filename beginning with a dash (e.g. '--config=alias.cat=version'). When Weblate later performs a repository update, Mercurial interprets the dash-prefixed filename as a command option rather than a path, executing attacker-controlled commands with the privileges of the Weblate service account. No public proof-of-concept was provided, but the fixing commit and PR are public and the flaw is a residual bypass of the earlier CVE-2022-23915 fix, lowering the reconstruction barrier.