CVE-2026-33220: Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Impact The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.
Patches https://github.com/WeblateOrg/weblate/pull/18516
Workarounds The CDN add-on is not enabled by default.
References Thanks to @spbavarva for reporting this responsibly via GitHub.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33220?
The severity of CVE-2026-33220 is considered to be high due to the potential for unauthorized local file access.
How do I fix CVE-2026-33220?
To fix CVE-2026-33220, upgrade to Weblate version 5.17 or later which addresses the vulnerability.
What types of systems are affected by CVE-2026-33220?
CVE-2026-33220 affects Weblate versions prior to 5.17, specifically impacting the translation memory API.
What are the implications of not addressing CVE-2026-33220?
Failing to address CVE-2026-33220 could allow attackers to read sensitive files from the server, compromising data security.
Is CVE-2026-33220 related to any specific feature in Weblate?
Yes, CVE-2026-33220 is related to the JavaScript localization CDN add-on which improperly handled file access controls.