CVE-2025-61587: Weblate integration with Anubis can lead to Open Redirect via redir parameter
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECTDOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site. The redirect can also be used to initiate drive-by downloads (redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.13.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61587?
CVE-2025-61587 is classified as a medium severity vulnerability.
How do I fix CVE-2025-61587?
To fix CVE-2025-61587, update Weblate to version 5.13.3 or later, or configure REDIRECT_DOMAINS properly.
What versions of Weblate are affected by CVE-2025-61587?
CVE-2025-61587 affects all versions of Weblate up to and including 5.13.2.
What type of vulnerability is CVE-2025-61587?
CVE-2025-61587 is an open redirect vulnerability.
What can an attacker do with CVE-2025-61587?
An attacker can exploit CVE-2025-61587 to redirect users to malicious sites through crafted URLs.