CVE-2026-41654: CWE-20: Improper Input Validation in WeblateOrg weblate
Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.
AI Analysis
Technical Summary
Weblate before version 5.17.1 suffers from improper input validation (CWE-20) when importing project backup ZIP files. An authenticated user with project.add permission can craft a component JSON file with a repository URL pointing to private addresses or using non-allow-listed schemes. Because Weblate uses Django's bulk_create method to persist components, it bypasses the validate_repo_url validator. Consequently, the attacker-controlled URL is written verbatim into the .git/config file during repository configuration. This vulnerability was patched in version 5.17.1.
Potential Impact
An attacker with project.add permission can cause Weblate to write arbitrary repository URLs, including those pointing to private network addresses or using disallowed schemes, into the .git/config file. This could potentially lead to unintended interactions with internal services or misuse of repository configuration. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond project.add, and limited confidentiality impact. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade Weblate to version 5.17.1 or later, where this vulnerability has been patched. Since the issue is fixed in the official release, applying this update is the recommended remediation. No additional vendor advisory content is provided, so patch status is based on the version information in the description.
CVE-2026-41654: CWE-20: Improper Input Validation in WeblateOrg weblate
Description
Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Weblate before version 5.17.1 suffers from improper input validation (CWE-20) when importing project backup ZIP files. An authenticated user with project.add permission can craft a component JSON file with a repository URL pointing to private addresses or using non-allow-listed schemes. Because Weblate uses Django's bulk_create method to persist components, it bypasses the validate_repo_url validator. Consequently, the attacker-controlled URL is written verbatim into the .git/config file during repository configuration. This vulnerability was patched in version 5.17.1.
Potential Impact
An attacker with project.add permission can cause Weblate to write arbitrary repository URLs, including those pointing to private network addresses or using disallowed schemes, into the .git/config file. This could potentially lead to unintended interactions with internal services or misuse of repository configuration. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required beyond project.add, and limited confidentiality impact. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade Weblate to version 5.17.1 or later, where this vulnerability has been patched. Since the issue is fixed in the official release, applying this update is the recommended remediation. No additional vendor advisory content is provided, so patch status is based on the version information in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-21T23:58:43.803Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fca37ecbff5d8610fd57a3
Added to database: 5/7/2026, 2:36:46 PM
Last enriched: 5/7/2026, 2:52:50 PM
Last updated: 5/8/2026, 10:57:11 AM
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.