CVE-2026-62326
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Weblate prior to version 2026.7 allows a user with the "Edit source" role to store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. This issue is fixed in version 2026.7.
Risk Assessment
Risk of denial-of-service attacks via CPU exhaustion from malicious regular expressions, potentially leading to service unavailability.
Recommendation
Upgrade Weblate to version 2026.7 or later and restrict source editing permissions to trusted users only.
Other vulnerabilities in Weblate
See all- CVE-2026-41654High
Weblate is a web-based localization tool. Prior to version 5.17.1, an authenticated user with project.add permissions could import a crafted project backup ZIP containing an attacker-chosen repo URL, potentially leading to data exposure.
- CVE-2026-21889High
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
- CVE-2025-64725Critical
Weblate before version 5.15 allows accepting an invitation opened by a different user. Version 5.15 contains a patch.
- CVE-2026-77573Low
Weblate prior to 2026.8 allows a user with permission to manage component repository URLs to perform SSRF against internal services through DNS rebinding during VCS operations. Hostname validation uses the first DNS resolution, but VCS clients perform a separate lookup, allowing redirection to an internal address.
- CVE-2026-77507Medium
Weblate prior to version 2026.8 does not apply permission checks in object-scoped RSS feeds, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations with anonymous access, metadata can be retrieved without authentication. This issue is fixed in version 2026.8.
- CVE-2026-62249Medium
Weblate prior to version 2026.7 allows an authenticated user with access to a project to retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. This issue is fixed in version 2026.7.
- CVE-2026-61792High
Weblate is a web-based continuous localization platform. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without confining them to the repository. This is an incomplete fix for CVE-2026-34242, allowing arbitrary file read. A user with project-admin privileges can disclose file contents on the host. Fixed in 2026.7.
- CVE-2026-61790Medium
Weblate prior to version 2026.7 does not enforce two-factor authentication (2FA) requirements for site-wide global permissions, even though a team can require 2FA for its members. A user belonging to a team with 2FA enforcement receives global permissions without 2FA configured, potentially including access to the site management interface. This issue is fixed in version 2026.7.
- CVE-2026-55228High
Weblate is a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations. By assigning projects to teams via unvalidated requests, users could grant access to unauthorized projects. This could expose private projects and allow operations outside intended permissions. Fixed in 2026.7.
- CVE-2026-55227Medium
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
Original NVD description (English source)
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. Regular expressions supplied through the regex: quality check and regex placeholders are compiled during validation but later run against translation content in RegexCheck and PlaceholderCheck with no time limit, so a catastrophic-backtracking pattern like ^(a|aa)+$ can consume CPU indefinitely. Because Weblate re-runs these checks for every linked target unit in the same request when a source unit's flags change, a single edit can trigger sustained CPU-bound denial of service. This issue is fixed in version 2026.7.