weblate 5.15: known vulnerabilities · Page 2

Could not compare 3 records. The results are incomplete.

1. CVE-2026-21889

   Low · CVSS 2.3EPSS 0.39%Fix available

   Weblate leaks information via screenshots

   Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

   weblatePython

   • Update to 5.15.2

   Published January 14, 2026Updated January 14, 2026

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

2. CVE-2025-68398

   Critical · CVSS 9.1EPSS 0.79%Fix available

   Weblate has git config file overwrite vulnerability that leads to remote code execution

   Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

   weblatePython

   • Update to 5.15.1

   Published December 18, 2025Updated February 6, 2026

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

3. CVE-2025-68279

   High · CVSS 7.7EPSS 0.41%Fix available

   Weblate has an arbitrary file read via symbolic links

   Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.

   weblatePython

   • Update to 5.15.1

   Published December 18, 2025Updated December 19, 2025

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗