Weblate vulnerabilities

Weblate is a web-based localization tool. Prior to version 5.17.1, an authenticated user with project.add permissions could import a crafted project backup ZIP containing an attacker-chosen repo URL, potentially leading to data exposure.

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

Weblate before version 5.15 allows accepting an invitation opened by a different user. Version 5.15 contains a patch.

Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on, potentially executing arbitrary commands with the privileges of the Weblate service account. This issue has been patched in version 2026.8.

Weblate prior to 2026.8 allows a user with permission to manage component repository URLs to perform SSRF against internal services through DNS rebinding during VCS operations. Hostname validation uses the first DNS resolution, but VCS clients perform a separate lookup, allowing redirection to an internal address.

Weblate prior to version 2026.8 does not apply permission checks in object-scoped RSS feeds, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations with anonymous access, metadata can be retrieved without authentication. This issue is fixed in version 2026.8.

Weblate prior to version 2026.7 allows a user with the "Edit source" role to store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. This issue is fixed in version 2026.7.

Weblate prior to version 2026.7 allows an authenticated user with access to a project to retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without confining them to the repository. This is an incomplete fix for CVE-2026-34242, allowing arbitrary file read. A user with project-admin privileges can disclose file contents on the host. Fixed in 2026.7.

Weblate prior to version 2026.7 does not enforce two-factor authentication (2FA) requirements for site-wide global permissions, even though a team can require 2FA for its members. A user belonging to a team with 2FA enforcement receives global permissions without 2FA configured, potentially including access to the site management interface. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations. By assigning projects to teams via unvalidated requests, users could grant access to unauthorized projects. This could expose private projects and allow operations outside intended permissions. Fixed in 2026.7.

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

Weblate prior to 2026.8 allows an authenticated user to change the account's primary email via PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing later team invitations to be accepted without mailbox access.

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping, potentially allowing malicious code execution.

Weblate, a web based localization tool, in versions prior to 5.15 allowed retrieving user notification settings or listing all users via API. Version 5.15 fixes the issue.

Weblate is a web-based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue.

Weblate prior to version 5.15 does not validate or sanitize the repository URL field in the Create Component functionality, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost and internal network addresses. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL, creating a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. Additionally, error messages enable local file enumeration via file:// requests, and in cloud environments internal-only endpoints such as cloud metadata services may be accessible.

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site.

Weblate, a web-based localization tool, contains a vulnerability in versions before 5.13.1 that causes long session expiry during second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.