CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
Impact The ALLOWEDASSETDOMAINS setting applied only to the first issued requests and didn't restrict possible redirects.
Patches https://github.com/WeblateOrg/weblate/pull/18550
References This issue was reported by @spbavarva via GitHub.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWEDASSETDOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33440?
CVE-2026-33440 has been classified with a medium severity due to its potential impact on authenticated users.
How do I fix CVE-2026-33440?
To fix CVE-2026-33440, upgrade Weblate to version 5.17 or later, where the ALLOWED_ASSET_DOMAINS setting has been correctly implemented.
Who is affected by CVE-2026-33440?
CVE-2026-33440 affects all versions of Weblate prior to 5.17.
What type of vulnerability is CVE-2026-33440?
CVE-2026-33440 is an authenticated Server-Side Request Forgery (SSRF) vulnerability.
Can CVE-2026-33440 affect my system's security?
Yes, CVE-2026-33440 can compromise your system's security by allowing attackers to manipulate server requests through redirect exploits.