p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in weblate

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für weblate: 0. Davon im KEV-Katalog: 0.

RSS ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 37

  1. CVE-2026-55228

    Hoch · CVSS 8.1EPSS 0,45%Korrektur verfügbar

    Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.

    weblatePython
    • Auf 2026.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-55227

    Mittel · CVSS 4.3EPSS 0,32%Korrektur verfügbar

    Observable object existence disclosure in private Weblate projects via globally scoped object lookups

    Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

    weblatePython
    • Auf 2026.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-45106

    Mittel · CVSS 4.6EPSS 0,29%Korrektur verfügbar

    Weblate: Stored HTML injection in editor search preview

    Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.

    weblatePython
    • Auf 2026.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-50127

    Mittel · CVSS 5.9EPSS 0,47%Korrektur verfügbar

    Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

    Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

    weblatePython
    • Auf 2026.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-44264

    Mittel · CVSS 4.3EPSS 0,37%Korrektur verfügbar

    Weblate is vulnerable to XSS via crafted Markdown

    Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.

    weblatePython
    • Auf 5.17.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-44263

    Mittel · CVSS 4.3EPSS 0,38%Korrektur verfügbar

    Weblate: Private Translation Enumeration via Screenshot API

    Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.

    weblatePython
    • Auf 5.17.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-41519

    Mittel · CVSS 4.2EPSS 0,37%Korrektur verfügbar

    Weblate's API Token Not Invalidated on Password Change

    Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

    weblatePython
    • Auf 5.17.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-41654

    Mittel · CVSS 5.3EPSS 0,5%Korrektur verfügbar

    Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

    Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim int

    weblatePython
    • Auf 5.17.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-40256

    Mittel · CVSS 5EPSS 0,37%Korrektur verfügbar

    Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

    Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-39845

    Mittel · CVSS 4.1EPSS 0,33%Korrektur verfügbar

    Weblate: SSRF via the webhook add-on using unprotected fetch_url()

    Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-34393

    Hoch · CVSS 8.8EPSS 0,54%Korrektur verfügbar

    Weblate: Privilege escalation in the user API endpoint

    Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-34244

    Mittel · CVSS 5EPSS 0,33%Korrektur verfügbar

    Weblate: SSRF via Project-Level Machinery Configuration

    Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machine

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-34242

    Hoch · CVSS 7.7EPSS 0,53%Korrektur verfügbar

    Weblate: Arbitrary File Read via Symlink

    Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-33440

    Mittel · CVSS 5EPSS 0,31%Korrektur verfügbar

    Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

    Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-33435

    Hoch · CVSS 8.1EPSS 0,88%Korrektur verfügbar

    Weblate: Remote code execution during backup restoration

    Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-33220

    Mittel · CVSS 6.8EPSS 0,39%Korrektur verfügbar

    Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

    Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-33214

    Mittel · CVSS 4.3EPSS 0,3%Korrektur verfügbar

    Weblate has improper access control for the translation memory API

    Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-33212

    Niedrig · CVSS 3.1EPSS 0,26%Korrektur verfügbar

    Weblate: Improper access control for pending tasks in API

    Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.

    weblatePython
    • Auf 5.17 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-27457

    Mittel · CVSS 4.3EPSS 0,43%Korrektur verfügbar

    Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

    Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.

    weblatePython
    • Auf 5.16.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-24126

    Mittel · CVSS 6.6EPSS 0,52%Öffentlicher ExploitKorrektur verfügbar

    Weblate has an argument injection in management console

    Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

    weblate weblatePython
    • Auf 5.16 aktualisieren
    • Auf 5.16.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →