CVE-2026-61792: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WeblateOrg weblate

Weblate versions before 2026.7 contain a path traversal vulnerability (CWE-22) in the App store metadata download feature. A project administrator can exploit this by influencing path resolution to access files outside the intended repository directory. This vulnerability is a partial fix failure from CVE-2026-34242, allowing arbitrary file read on the host system. The vulnerability has a CVSS 3.1 score of 7.7, indicating high severity with network attack vector, low attack complexity, and requiring project administrator privileges. The flaw does not impact integrity or availability but compromises confidentiality by disclosing sensitive files. The issue is fixed in version 2026.7.

An attacker with project-administrator privileges can read arbitrary files on the Weblate host outside the project repository, leading to potential disclosure of sensitive information. The vulnerability does not affect integrity or availability but has a high confidentiality impact. No known exploits in the wild have been reported.

Upgrade Weblate to version 2026.7 or later, where this path traversal vulnerability is fixed. Since this is an official fix, applying the update fully mitigates the issue. No additional mitigations are indicated by the vendor advisory.