WeblateOrg vulnerabilities and threats

Weblate versions from 4.11.1 up to but not including 2026.8 contain an OS command injection vulnerability in the Mercurial backend. This flaw allows an authenticated user with project-scoped component.edit permission to exploit repository filenames starting with a dash (-) as Mercurial options, potentially leading to arbitrary command execution with the Weblate service account privileges. This vulnerability is a residual issue from an incomplete fix for CVE-2022-23915 and has been addressed in version 2026.8.

CVE-2026-62364 is a vulnerability in WeblateOrg's wlc command-line client prior to version 2.0.1. The issue involves exposure of an unscoped API token when wlc automatically discovers configuration files and uses the token without a matching URL. This can cause the token to be sent to an attacker-controlled URL if wlc runs in an untrusted repository or directory. The vulnerability is fixed in version 2.0.1.

CVE-2026-77573 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Weblate versions prior to 2026.8. It allows a user with permission to manage component repository URLs to perform server-side request forgery (SSRF) against internal services via DNS rebinding during version control system (VCS) operations. The vulnerability arises because Weblate validates the hostname's initial DNS resolution but the external VCS clients perform a separate DNS lookup later, enabling an attacker-controlled hostname to be redirected to internal or private addresses. This can lead to unauthorized access to internal VCS-compatible services and potential exposure of private repository contents. The issue affects installations that allow untrusted repository hostnames while using the VCS_RESTRICT_PRIVATE=True setting. The vulnerability is fixed in Weblate version 2026.8.

Weblate versions prior to 2026.8 have a vulnerability where object-scoped RSS feeds do not enforce permission checks, allowing unauthorized users to access change-history metadata from private projects and restricted components. This metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, but not the translated-string content. The issue affects installations that allow anonymous access and use private or restricted projects. The vulnerability is fixed in version 2026.8.

Weblate versions prior to 2026.7 contain a vulnerability where users with the "Edit source" role can inject malicious regular expressions without timeout limits. This can cause excessive CPU consumption and lead to denial of service. The issue arises because regex checks are re-run multiple times per request without time limits, allowing catastrophic backtracking patterns to stall the system. This vulnerability is fixed in version 2026.7.

Weblate versions prior to 2026.7 contain a vulnerability where authenticated users with project access can retrieve change history of restricted components via nested API endpoints without proper component-level access checks. This exposure allows unauthorized viewing of sensitive translation data. The issue is fixed in version 2026.7.

CVE-2026-61792 is a path traversal vulnerability in Weblate prior to version 2026.7. It allows a project administrator to read files outside their repository via the App store metadata download feature due to insufficient path restriction. This vulnerability is an incomplete fix of a previous issue (CVE-2026-34242) and permits disclosure of arbitrary files on the Weblate host. The issue is resolved in version 2026.7.

Weblate versions prior to 2026.7 have an improper access control vulnerability where two-factor authentication (2FA) enforcement is inconsistent. While teams can require 2FA for team permissions, this requirement is not enforced for site-wide global permissions. As a result, users without 2FA configured can still receive and act on global permissions, including accessing the site management interface. This issue is fixed in version 2026.7.

CVE-2026-55228 is an authorization bypass vulnerability in Weblate before version 2026.7. The REST API did not properly enforce project- and workspace-scoped team permissions, allowing users to assign projects to teams via unvalidated API requests. This could grant unauthorized access to private projects and allow unauthorized translation, repository, and project management operations. The issue is fixed in version 2026.7.

Weblate versions prior to 2026.7 have an information disclosure vulnerability where unauthorized users can infer the existence of objects in private projects due to differing HTTP response codes (403 vs 404). This discrepancy allows attackers to confirm whether certain objects exist without access. The issue is fixed in version 2026.7.

Weblate versions prior to 2026.8 contain an authentication bypass vulnerability where an authenticated user can change their account's primary email without verifying the new address. This allows acceptance of team invitations sent to the new email without access to the intended recipient's mailbox. The issue is fixed in version 2026.8.

Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.

A Server-Side Request Forgery (SSRF) vulnerability exists in Weblate versions from 5.15 up to but not including 2026.6. The issue arises because the VCS_RESTRICT_PRIVATE setting did not correctly handle certain transitional IPv6 ranges, multicast addresses, and some semi-private IPv4 ranges, allowing bypass of private network restrictions. This vulnerability has been addressed in version 2026.6.

CVE-2026-42150 is a cross-site scripting (XSS) vulnerability in the Weblate command-line client (wlc) prior to version 2.0.0. The vulnerability arises because the HTML output format embeds API response data into HTML without proper escaping, which can lead to XSS when the output is viewed in a browser. This issue has been addressed in version 2.0.0 of wlc. The vulnerability has a medium severity with a CVSS score of 5.1.

Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.

Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

CVE-2026-41654 is a medium severity vulnerability in Weblate versions prior to 5.17.1. It allows an authenticated user with project.add permission to import a crafted project backup ZIP containing a component JSON with a malicious repository URL. This URL can point to private network addresses or use disallowed schemes, bypassing input validation due to the use of bulk_create which skips Django's full_clean validation. The malicious URL is then written directly into the . git/config file. This issue has been fixed in Weblate version 5.17.

CVE-2026-40256 is a path traversal vulnerability in Weblate versions prior to 5.17. The issue arises because repository-boundary validation uses string prefix checks on absolute paths without proper path-segment awareness, allowing bypass when an external path shares the same prefix as the repository path. This vulnerability has been fixed in Weblate version 5.17. The CVSS score is 5.0, indicating a medium severity level.

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.