Weblateorg
Monthly
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. No public exploit has been identified at time of analysis; the CVSS score of 7.7 High reflects scope change due to cross-boundary file disclosure, while the project-administrator privilege requirement limits the exploitable population.
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allowing any authenticated low-privilege user to assign unauthorized projects or workspaces to a team via the API. The root serializer field `defining_workspace` resolved primary keys against `Workspace.objects.all()` without filtering by the requesting user's permissions, enabling horizontal privilege escalation to private projects. Vendor-released patch 2026.7 is confirmed; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive fields (like roles or permissions) of any user account through the REST API's user patching endpoint, leading to full system compromise. The vulnerability stems from insufficient field-level authorization, and the EPSS exploitation probability is very low (0.04%) with no known active exploitation; a vendor patch is available in version 5.17.
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive files from the server via symlink traversal in the ZIP download feature. No active exploitation or public exploit code has been identified, and the EPSS score (0.01%) indicates very low likelihood of exploitation. A vendor-released patch is available in Weblate 5.17.
Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticated users with project-creation privileges. Backup archives were extracted without filtering Git (`.git/config`, `.git/hooks/*`, `.git/modules/`) and Mercurial (`.hg/hgrc`) configuration files, allowing a crafted archive to plant malicious VCS hooks or rewrite repository configuration. When Weblate subsequently performs git operations on the restored component, attacker-supplied hook scripts execute with server-process privileges. No public exploit or active exploitation has been confirmed (SSVC: Exploitation none; EPSS 0.33%).
API token disclosure in the Weblate wlc command-line client before 2.0.1 allows an attacker-controlled project configuration to redirect an unscoped API token to a server the attacker controls. When wlc is run inside an untrusted repository, pull-request checkout, or a directory with an untrusted ancestor whose .weblate, .weblate.ini, or weblate.ini sets an API url, and the operator supplies a token through WLC_KEY or --key without also pinning WLC_URL or --url, the client transmits that token to the project-configured destination. Exploitation requires local execution of wlc, all three configuration preconditions to hold simultaneously, and user interaction; no public exploit was identified at time of analysis, and the overall risk is low (CVSS 2.3 / assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. Triggering a clone, fetch, push, or similar operation then causes Weblate to connect to internal VCS-compatible services and potentially expose their contents. No public exploit has been identified at time of analysis, though the DNS rebinding technique is well-understood and toolkits for it exist.
Object-scoped RSS feeds in Weblate prior to version 2026.8 bypass the platform's permission model, exposing change-history metadata from private projects and restricted components to any requester - including unauthenticated users on installations that permit anonymous access. The exposed metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation unit links, enabling enumeration of contributor identity and project structure in otherwise-private deployments. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the lack of any exploitation prerequisite on anonymously accessible instances makes it straightforward to abuse with standard HTTP tooling.
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'Edit source' role to induce sustained CPU exhaustion by storing a catastrophically-backtracking pattern in a source string's quality-check flags. Both the RegexCheck and PlaceholderCheck mechanisms compile user-supplied expressions at validation time but execute them without any runtime timeout, so a single malicious flag edit can pin server CPU indefinitely by re-triggering evaluation across every linked translation unit in the same request. No public exploit code exists and the issue is not listed in CISA KEV, but the low complexity and clear role-based attack path make it a credible internal or supply-chain threat for multi-contributor Weblate deployments.
Nested API change endpoints in Weblate prior to version 2026.7 bypass component-level access controls, exposing change history of restricted components to authenticated project members who lack direct view permissions. A low-privileged project member can call the project-, component-, or translation-level change list endpoints to enumerate change records for restricted components - including source and translated string content, component identity, and change metadata - that return 404 on direct component access. No public exploit or CISA KEV listing has been identified; real-world risk is conditional on use of Weblate's restricted component feature.
Global permission bypass in Weblate prior to 2026.7 allows authenticated team members to receive site-wide management permissions without satisfying their team's enforced two-factor authentication requirement. While 2FA enforcement was correctly applied to project-, component-, and workspace-scoped permissions, the same gate was absent for global permissions, meaning a user lacking a configured TOTP device could still access the site management interface at /manage/. No public exploit code is identified at time of analysis, and the issue is fixed in version 2026.7.
Object existence enumeration in Weblate prior to version 2026.7 allows authenticated low-privilege users to infer whether objects exist within private projects by observing differential HTTP response codes - HTTP 403 (Forbidden) for existing-but-inaccessible objects versus HTTP 404 (Not Found) for truly absent ones. Affected endpoints performing globally-scoped ORM lookups across changes, comments, and announcements fail to restrict results to projects the requesting user is authorized to view. No public exploit has been identified and this is not listed in CISA KEV; the CVSS 4.3 Medium rating reflects the authentication prerequisite and the narrow confidentiality impact (existence inference only, no content disclosure).
Server-Side Request Forgery in Weblate's VCS_RESTRICT_PRIVATE control (versions 5.15 through pre-2026.6) allows bypassing of outbound request restrictions via IPv6 transition address encoding techniques. By supplying a hostname whose DNS AAAA record resolves to a NAT64-wrapped, 6to4-wrapped, or IPv4-compatible IPv6 address that encodes a private IPv4 endpoint, an attacker causes Weblate's validator to pass the address as globally routable while the host kernel routes the packet to the embedded private IPv4 target. The vulnerability carries High confidentiality impact (CVSS 5.9, AV:N/AC:H) because SSRF can expose internal services such as cloud IMDS credential endpoints; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in wlc command-line client versions prior to 2.0.0 allows authenticated users with high privileges to inject malicious HTML/JavaScript into API responses, which are then embedded unescaped in HTML output. When the HTML output is rendered in a browser, this enables XSS attacks. The vulnerability requires explicit use of the HTML output format (non-default), user interaction to open/view the HTML file, and elevated API credentials, limiting real-world risk despite the network vector.
Low-severity path traversal in Weblate prior to 5.17 allows authenticated users to bypass repository boundary checks by crafting symlinks with colliding path prefixes, potentially reading files outside the intended repository scope. No active exploitation or public exploit code is known, and the vulnerability has been patched in version 5.17.
Server-side request forgery in Weblate's webhook add-on allows high-privileged users to bypass existing SSRF protections and make requests to internal network resources. Versions prior to 5.17 are affected; the fix introduces a new restriction setting that blocks private IP ranges by default. No active exploitation is reported (EPSS 0.01%, no CISA KEV entry), and no public exploit code has been identified at this time.
Server-Side Request Forgery in Weblate's project-level machine translation configuration allows an authenticated project administrator to probe internal network services and read partial responses. Any user holding the per-project 'Administration' role (which grants project.edit permission) can supply a crafted URL as a machine translation service endpoint; during validation Weblate issues an outbound HTTP request to that URL and reflects up to 200 characters of the response body in the resulting error message. All Weblate deployments running versions prior to 5.17 are affected; no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery in Weblate prior to version 5.17 allows authenticated users to bypass the ALLOWED_ASSET_DOMAINS allowlist via HTTP redirects, forcing the server to request unintended hosts. This can lead to low confidentiality impact through information disclosure. The vulnerability is fixed in version 5.17, and no public exploit or active exploitation has been identified.
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
Weblate's tasks API prior to version 5.17 permitted authenticated users to retrieve operation logs for pending (in-flight) background tasks belonging to project scopes outside their access level. The access control check enforcing component-level permissions was not applied to tasks in PENDING state because the component context was unavailable until task completion; the fix caches component metadata at task creation so permissions can be verified regardless of task state. No public exploit code exists, exploitation probability is very low (EPSS 0.03%), and CISA KEV does not list this vulnerability.
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. No public exploit has been identified at time of analysis; the CVSS score of 7.7 High reflects scope change due to cross-boundary file disclosure, while the project-administrator privilege requirement limits the exploitable population.
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allowing any authenticated low-privilege user to assign unauthorized projects or workspaces to a team via the API. The root serializer field `defining_workspace` resolved primary keys against `Workspace.objects.all()` without filtering by the requesting user's permissions, enabling horizontal privilege escalation to private projects. Vendor-released patch 2026.7 is confirmed; no public exploit code or CISA KEV listing exists at time of analysis.
Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive fields (like roles or permissions) of any user account through the REST API's user patching endpoint, leading to full system compromise. The vulnerability stems from insufficient field-level authorization, and the EPSS exploitation probability is very low (0.04%) with no known active exploitation; a vendor patch is available in version 5.17.
Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive files from the server via symlink traversal in the ZIP download feature. No active exploitation or public exploit code has been identified, and the EPSS score (0.01%) indicates very low likelihood of exploitation. A vendor-released patch is available in Weblate 5.17.
Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticated users with project-creation privileges. Backup archives were extracted without filtering Git (`.git/config`, `.git/hooks/*`, `.git/modules/`) and Mercurial (`.hg/hgrc`) configuration files, allowing a crafted archive to plant malicious VCS hooks or rewrite repository configuration. When Weblate subsequently performs git operations on the restored component, attacker-supplied hook scripts execute with server-process privileges. No public exploit or active exploitation has been confirmed (SSVC: Exploitation none; EPSS 0.33%).
API token disclosure in the Weblate wlc command-line client before 2.0.1 allows an attacker-controlled project configuration to redirect an unscoped API token to a server the attacker controls. When wlc is run inside an untrusted repository, pull-request checkout, or a directory with an untrusted ancestor whose .weblate, .weblate.ini, or weblate.ini sets an API url, and the operator supplies a token through WLC_KEY or --key without also pinning WLC_URL or --url, the client transmits that token to the project-configured destination. Exploitation requires local execution of wlc, all three configuration preconditions to hold simultaneously, and user interaction; no public exploit was identified at time of analysis, and the overall risk is low (CVSS 2.3 / assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N).
DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. Triggering a clone, fetch, push, or similar operation then causes Weblate to connect to internal VCS-compatible services and potentially expose their contents. No public exploit has been identified at time of analysis, though the DNS rebinding technique is well-understood and toolkits for it exist.
Object-scoped RSS feeds in Weblate prior to version 2026.8 bypass the platform's permission model, exposing change-history metadata from private projects and restricted components to any requester - including unauthenticated users on installations that permit anonymous access. The exposed metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation unit links, enabling enumeration of contributor identity and project structure in otherwise-private deployments. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the lack of any exploitation prerequisite on anonymously accessible instances makes it straightforward to abuse with standard HTTP tooling.
Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'Edit source' role to induce sustained CPU exhaustion by storing a catastrophically-backtracking pattern in a source string's quality-check flags. Both the RegexCheck and PlaceholderCheck mechanisms compile user-supplied expressions at validation time but execute them without any runtime timeout, so a single malicious flag edit can pin server CPU indefinitely by re-triggering evaluation across every linked translation unit in the same request. No public exploit code exists and the issue is not listed in CISA KEV, but the low complexity and clear role-based attack path make it a credible internal or supply-chain threat for multi-contributor Weblate deployments.
Nested API change endpoints in Weblate prior to version 2026.7 bypass component-level access controls, exposing change history of restricted components to authenticated project members who lack direct view permissions. A low-privileged project member can call the project-, component-, or translation-level change list endpoints to enumerate change records for restricted components - including source and translated string content, component identity, and change metadata - that return 404 on direct component access. No public exploit or CISA KEV listing has been identified; real-world risk is conditional on use of Weblate's restricted component feature.
Global permission bypass in Weblate prior to 2026.7 allows authenticated team members to receive site-wide management permissions without satisfying their team's enforced two-factor authentication requirement. While 2FA enforcement was correctly applied to project-, component-, and workspace-scoped permissions, the same gate was absent for global permissions, meaning a user lacking a configured TOTP device could still access the site management interface at /manage/. No public exploit code is identified at time of analysis, and the issue is fixed in version 2026.7.
Object existence enumeration in Weblate prior to version 2026.7 allows authenticated low-privilege users to infer whether objects exist within private projects by observing differential HTTP response codes - HTTP 403 (Forbidden) for existing-but-inaccessible objects versus HTTP 404 (Not Found) for truly absent ones. Affected endpoints performing globally-scoped ORM lookups across changes, comments, and announcements fail to restrict results to projects the requesting user is authorized to view. No public exploit has been identified and this is not listed in CISA KEV; the CVSS 4.3 Medium rating reflects the authentication prerequisite and the narrow confidentiality impact (existence inference only, no content disclosure).
Server-Side Request Forgery in Weblate's VCS_RESTRICT_PRIVATE control (versions 5.15 through pre-2026.6) allows bypassing of outbound request restrictions via IPv6 transition address encoding techniques. By supplying a hostname whose DNS AAAA record resolves to a NAT64-wrapped, 6to4-wrapped, or IPv4-compatible IPv6 address that encodes a private IPv4 endpoint, an attacker causes Weblate's validator to pass the address as globally routable while the host kernel routes the packet to the embedded private IPv4 target. The vulnerability carries High confidentiality impact (CVSS 5.9, AV:N/AC:H) because SSRF can expose internal services such as cloud IMDS credential endpoints; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in wlc command-line client versions prior to 2.0.0 allows authenticated users with high privileges to inject malicious HTML/JavaScript into API responses, which are then embedded unescaped in HTML output. When the HTML output is rendered in a browser, this enables XSS attacks. The vulnerability requires explicit use of the HTML output format (non-default), user interaction to open/view the HTML file, and elevated API credentials, limiting real-world risk despite the network vector.
Low-severity path traversal in Weblate prior to 5.17 allows authenticated users to bypass repository boundary checks by crafting symlinks with colliding path prefixes, potentially reading files outside the intended repository scope. No active exploitation or public exploit code is known, and the vulnerability has been patched in version 5.17.
Server-side request forgery in Weblate's webhook add-on allows high-privileged users to bypass existing SSRF protections and make requests to internal network resources. Versions prior to 5.17 are affected; the fix introduces a new restriction setting that blocks private IP ranges by default. No active exploitation is reported (EPSS 0.01%, no CISA KEV entry), and no public exploit code has been identified at this time.
Server-Side Request Forgery in Weblate's project-level machine translation configuration allows an authenticated project administrator to probe internal network services and read partial responses. Any user holding the per-project 'Administration' role (which grants project.edit permission) can supply a crafted URL as a machine translation service endpoint; during validation Weblate issues an outbound HTTP request to that URL and reflects up to 200 characters of the response body in the resulting error message. All Weblate deployments running versions prior to 5.17 are affected; no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Server-Side Request Forgery in Weblate prior to version 5.17 allows authenticated users to bypass the ALLOWED_ASSET_DOMAINS allowlist via HTTP redirects, forcing the server to request unintended hosts. This can lead to low confidentiality impact through information disclosure. The vulnerability is fixed in version 5.17, and no public exploit or active exploitation has been identified.
Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation memory API. Versions prior to 5.17 are affected; the fix in 5.17 adds filename validation to prevent directory traversal and restricts remote URLs to allowed domains. No active exploitation has been reported (CISA KEV not listed, SSVC exploitation status none), and EPSS risk is very low (0.04%).
Low-privileged users can modify Weblate translation memory via improperly exposed API endpoints in versions prior to 5.17, leading to unauthorized data manipulation without affecting confidentiality or availability. The vulnerability is not known to be actively exploited and has a very low exploitation probability (EPSS 0.01%).
Weblate's tasks API prior to version 5.17 permitted authenticated users to retrieve operation logs for pending (in-flight) background tasks belonging to project scopes outside their access level. The access control check enforcing component-level permissions was not applied to tasks in PENDING state because the component context was unavailable until task completion; the fix caches component metadata at task creation so permissions can be verified regardless of task state. No public exploit code exists, exploitation probability is very low (EPSS 0.03%), and CISA KEV does not list this vulnerability.