CVE-2026-41654: CWE-20: Improper Input Validation in WeblateOrg weblate
CVE-2026-41654 is a medium severity vulnerability in Weblate versions prior to 5.17.1. It allows an authenticated user with project.add permission to import a crafted project backup ZIP containing a component JSON with a malicious repository URL. This URL can point to private network addresses or use disallowed schemes, bypassing input validation due to the use of bulk_create which skips Django's full_clean validation. The malicious URL is then written directly into the . git/config file. This issue has been fixed in Weblate version 5.17.
AI Analysis
Technical Summary
Weblate before version 5.17.1 contains an improper input validation vulnerability (CWE-20) where an authenticated user with project.add permission can import a specially crafted project backup ZIP file. The crafted component JSON includes a repo URL that can point to private addresses (e.g., http://127.0.0.1:9999/) or use non-allow-listed schemes (e.g., file://, git://). Because Weblate uses Django's bulk_create method to persist components, it bypasses the full_clean() method and the validate_repo_url validator. Consequently, the malicious URL is written verbatim into the .git/config file by the configure_repo function. This vulnerability was patched in version 5.17.1.
Potential Impact
An attacker with project.add permission can cause Weblate to write attacker-controlled repository URLs into the .git/config file. This could potentially lead to unintended interactions with private network resources or unsupported URL schemes. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low complexity, and no required user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Weblate to version 5.17.1 or later, where this vulnerability has been patched. No other mitigation is indicated or required according to the available data.
CVE-2026-41654: CWE-20: Improper Input Validation in WeblateOrg weblate
Description
CVE-2026-41654 is a medium severity vulnerability in Weblate versions prior to 5.17.1. It allows an authenticated user with project.add permission to import a crafted project backup ZIP containing a component JSON with a malicious repository URL. This URL can point to private network addresses or use disallowed schemes, bypassing input validation due to the use of bulk_create which skips Django's full_clean validation. The malicious URL is then written directly into the . git/config file. This issue has been fixed in Weblate version 5.17.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Weblate before version 5.17.1 contains an improper input validation vulnerability (CWE-20) where an authenticated user with project.add permission can import a specially crafted project backup ZIP file. The crafted component JSON includes a repo URL that can point to private addresses (e.g., http://127.0.0.1:9999/) or use non-allow-listed schemes (e.g., file://, git://). Because Weblate uses Django's bulk_create method to persist components, it bypasses the full_clean() method and the validate_repo_url validator. Consequently, the malicious URL is written verbatim into the .git/config file by the configure_repo function. This vulnerability was patched in version 5.17.1.
Potential Impact
An attacker with project.add permission can cause Weblate to write attacker-controlled repository URLs into the .git/config file. This could potentially lead to unintended interactions with private network resources or unsupported URL schemes. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low complexity, and no required user interaction. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Weblate to version 5.17.1 or later, where this vulnerability has been patched. No other mitigation is indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-21T23:58:43.803Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fca37ecbff5d8610fd57a3
Added to database: 05/07/2026, 14:36:46 UTC
Last enriched: 05/15/2026, 10:58:48 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.