CVE-2026-33220: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WeblateOrg weblate
CVE-2026-33220 is a medium severity vulnerability in Weblate versions prior to 5. 17 involving improper limitation of a pathname to a restricted directory (path traversal) in the translation memory API. This flaw allowed access to unintended endpoints without proper access control. The issue has been fixed in Weblate version 5. 17. Users unable to upgrade immediately can mitigate risk by disabling the translation memory API feature, which is not enabled by default unless the CDN add-on is used.
AI Analysis
Technical Summary
Weblate versions before 5.17 contain a path traversal vulnerability (CWE-22) in the translation memory API, which exposes unintended endpoints lacking proper access control. This can lead to unauthorized access to restricted directories or data. The vulnerability is addressed in version 5.17 by correcting access control mechanisms. The translation memory API feature is disabled by default unless the CDN add-on is enabled, providing an interim mitigation.
Potential Impact
The vulnerability allows an attacker with limited privileges to access restricted directories or data through the translation memory API due to improper path validation. According to the CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N), the vulnerability can be exploited remotely with low attack complexity, requires low privileges and user interaction, and results in a high confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade Weblate to version 5.17 or later, where this vulnerability is fixed. If immediate upgrading is not possible, disable the translation memory API feature as it is not enabled by default unless the CDN add-on is active. This effectively mitigates the risk until an official patch can be applied.
CVE-2026-33220: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WeblateOrg weblate
Description
CVE-2026-33220 is a medium severity vulnerability in Weblate versions prior to 5. 17 involving improper limitation of a pathname to a restricted directory (path traversal) in the translation memory API. This flaw allowed access to unintended endpoints without proper access control. The issue has been fixed in Weblate version 5. 17. Users unable to upgrade immediately can mitigate risk by disabling the translation memory API feature, which is not enabled by default unless the CDN add-on is used.
CVSS v3.1
Score 6.8medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Weblate versions before 5.17 contain a path traversal vulnerability (CWE-22) in the translation memory API, which exposes unintended endpoints lacking proper access control. This can lead to unauthorized access to restricted directories or data. The vulnerability is addressed in version 5.17 by correcting access control mechanisms. The translation memory API feature is disabled by default unless the CDN add-on is enabled, providing an interim mitigation.
Potential Impact
The vulnerability allows an attacker with limited privileges to access restricted directories or data through the translation memory API due to improper path validation. According to the CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N), the vulnerability can be exploited remotely with low attack complexity, requires low privileges and user interaction, and results in a high confidentiality impact without affecting integrity or availability. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade Weblate to version 5.17 or later, where this vulnerability is fixed. If immediate upgrading is not possible, disable the translation memory API feature as it is not enabled by default unless the CDN add-on is active. This effectively mitigates the risk until an official patch can be applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-17T23:23:58.314Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69dfd9a582d89c981f8a79d3
Added to database: 4/15/2026, 6:32:05 PM
Last enriched: 4/22/2026, 11:10:52 PM
Last updated: 5/29/2026, 5:11:33 PM
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.