CVE-2026-92803

MediumCVSS 5.3

Published: 16/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

35th percentile - higher than 35% of all known CVEs

Summary

LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.

Risk Assessment

Unauthenticated attackers can download translated files, potentially leading to exposure of sensitive content or breach of access controls.

Recommendation

Update LibreTranslate to a version newer than 1.9.6 that includes the fix. Additionally, restrict access to the download_file route and monitor its usage.

Other vulnerabilities in LibreTranslate

CVE-2026-57942Medium
LibreTranslate through version 1.9.7 has an IP spoofing vulnerability in the get_remote_address() function. An unauthenticated attacker can inject arbitrary values into the X-Forwarded-For header, bypassing per-IP rate limiting and flood bans.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS