Weblate versions before 5.17 contain a path traversal vulnerability (CWE-22) due to improper limitation of pathnames in the translation memory API. This API exposed unintended endpoints that lacked proper access control, potentially allowing attackers with limited privileges to access sensitive files outside the intended directory scope. The vulnerability is addressed in version 5.17 by fixing the access control mechanisms. The CDN add-on, which enables this feature, is disabled by default, providing a temporary mitigation if upgrading is delayed.

An attacker with limited privileges can exploit the path traversal vulnerability to access sensitive files outside the intended directories, potentially leading to information disclosure (CWE-200). The CVSS 3.1 base score is 6.8 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high confidentiality impact without integrity or availability impact.

Upgrade Weblate to version 5.17 or later, where this vulnerability is fixed. If immediate upgrading is not feasible, disable the translation memory API feature, as the CDN add-on that enables this feature is not enabled by default. This temporary measure reduces exposure until the official fix can be applied.