p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de weblate

Vulnerabilidades publicadas para weblate en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 37

  1. CVE-2026-55228

    Alta · CVSS 8.1EPSS 0,45%Corrección disponible

    Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.

    weblatePython
    • Actualiza a 2026.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-55227

    Media · CVSS 4.3EPSS 0,32%Corrección disponible

    Observable object existence disclosure in private Weblate projects via globally scoped object lookups

    Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

    weblatePython
    • Actualiza a 2026.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-45106

    Media · CVSS 4.6EPSS 0,29%Corrección disponible

    Weblate: Stored HTML injection in editor search preview

    Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.

    weblatePython
    • Actualiza a 2026.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-50127

    Media · CVSS 5.9EPSS 0,47%Corrección disponible

    Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

    Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

    weblatePython
    • Actualiza a 2026.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-44264

    Media · CVSS 4.3EPSS 0,37%Corrección disponible

    Weblate is vulnerable to XSS via crafted Markdown

    Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.

    weblatePython
    • Actualiza a 5.17.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-44263

    Media · CVSS 4.3EPSS 0,38%Corrección disponible

    Weblate: Private Translation Enumeration via Screenshot API

    Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.

    weblatePython
    • Actualiza a 5.17.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-41519

    Media · CVSS 4.2EPSS 0,37%Corrección disponible

    Weblate's API Token Not Invalidated on Password Change

    Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.

    weblatePython
    • Actualiza a 5.17.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-41654

    Media · CVSS 5.3EPSS 0,5%Corrección disponible

    Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

    Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim int

    weblatePython
    • Actualiza a 5.17.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2026-40256

    Media · CVSS 5EPSS 0,37%Corrección disponible

    Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

    Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2026-39845

    Media · CVSS 4.1EPSS 0,33%Corrección disponible

    Weblate: SSRF via the webhook add-on using unprotected fetch_url()

    Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2026-34393

    Alta · CVSS 8.8EPSS 0,54%Corrección disponible

    Weblate: Privilege escalation in the user API endpoint

    Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2026-34244

    Media · CVSS 5EPSS 0,33%Corrección disponible

    Weblate: SSRF via Project-Level Machinery Configuration

    Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machine

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2026-34242

    Alta · CVSS 7.7EPSS 0,53%Corrección disponible

    Weblate: Arbitrary File Read via Symlink

    Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-33440

    Media · CVSS 5EPSS 0,31%Corrección disponible

    Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

    Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-33435

    Alta · CVSS 8.1EPSS 0,88%Corrección disponible

    Weblate: Remote code execution during backup restoration

    Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-33220

    Media · CVSS 6.8EPSS 0,39%Corrección disponible

    Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

    Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-33214

    Media · CVSS 4.3EPSS 0,3%Corrección disponible

    Weblate has improper access control for the translation memory API

    Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-33212

    Baja · CVSS 3.1EPSS 0,26%Corrección disponible

    Weblate: Improper access control for pending tasks in API

    Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.

    weblatePython
    • Actualiza a 5.17
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-27457

    Media · CVSS 4.3EPSS 0,43%Corrección disponible

    Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

    Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.

    weblatePython
    • Actualiza a 5.16.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2026-24126

    Media · CVSS 6.6EPSS 0,52%Código de explotación públicoCorrección disponible

    Weblate has an argument injection in management console

    Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

    weblate weblatePython
    • Actualiza a 5.16
    • Actualiza a 5.16.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →