Weblate is a web-based localization platform that supports multiple version control systems (VCS) for managing translation components. In versions prior to 5.15, the Create Component feature allows authorized users to add new translation components by specifying a repository URL and VCS type. When Mercurial is selected as the VCS, the application fails to validate or sanitize the repository URL input, permitting attackers to supply arbitrary URLs with various protocols, including HTTP, file, and others. This lack of validation enables a server-side request forgery (SSRF) primitive, where the Weblate server makes HTTP requests to attacker-controlled or internal network resources and returns the full HTTP response content to the user. Additionally, attempts to access local files via file:// URLs can reveal the presence or absence of files on the server through distinct error messages, effectively enabling local file enumeration. In cloud deployments, this SSRF can be leveraged to access sensitive internal endpoints such as cloud metadata services, which often contain credentials and tokens, potentially leading to full environment compromise. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), but the core issue is SSRF due to unsanitized URL input. The Git backend is unaffected because it blocks file protocol URLs and does not expose HTTP response content in error messages. The issue was resolved in Weblate 5.15 by implementing proper validation and sanitization of repository URLs. As a temporary workaround, administrators can remove Mercurial from the VCS_BACKENDS configuration to prevent exploitation. The CVSS v3.1 score is 5.0 (medium), reflecting network attack vector, low complexity, requiring privileges but no user interaction, with limited confidentiality impact and no integrity or availability impact. No known exploits have been reported in the wild.

For European organizations using Weblate versions prior to 5.15, this vulnerability poses a significant risk, especially for those deploying Weblate in cloud environments or with sensitive internal network resources. Attackers with authorized access can exploit the SSRF to probe internal services, potentially accessing internal APIs, cloud metadata endpoints, or other sensitive infrastructure components that are not exposed externally. This can lead to credential disclosure, unauthorized access to internal systems, and potentially full compromise of the hosting environment. The ability to enumerate local files can also aid attackers in mapping the server filesystem, facilitating further targeted attacks. Organizations relying on Mercurial as their VCS backend are particularly vulnerable, while those using Git are not affected. The medium severity rating indicates a moderate risk, but the potential for cloud metadata service access elevates the threat in cloud-hosted deployments. This vulnerability could disrupt localization workflows and compromise the confidentiality of internal resources, impacting compliance with data protection regulations such as GDPR if sensitive data is exposed.

European organizations should prioritize upgrading Weblate to version 5.15 or later, where the vulnerability is fully addressed through proper input validation and sanitization. If immediate upgrade is not feasible, administrators should remove Mercurial from the VCS_BACKENDS configuration to disable the vulnerable backend, effectively mitigating the SSRF risk. Additionally, organizations should audit and restrict access to the Weblate administrative interface to trusted users only, minimizing the risk of exploitation by unauthorized actors. Network segmentation and firewall rules should be enforced to limit the Weblate server's ability to access internal services and cloud metadata endpoints. Monitoring and logging of Weblate server requests can help detect suspicious SSRF attempts. Finally, organizations should review their cloud environment's metadata service access policies, such as enabling metadata service version 2 (IMDSv2) in AWS, to reduce the risk of credential exposure via SSRF.