CVE-2026-41654: Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Impact An authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulkcreate([component])[0], which bypasses Django's fullclean() and therefore never runs the validaterepourl validator. The URL is subsequently written verbatim into .git/config by configurerepo(pull=False).
Patches https://github.com/WeblateOrg/weblate/pull/19061 https://github.com/WeblateOrg/weblate/pull/19062
Workarounds Limiting who can create projects limits the scope.
Resources Weblate thanks @fg0x0 for reporting this vulnerability via GitHub.
Other sources
Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulkcreate([component])[0], which bypasses Django's fullclean() and therefore never runs the validaterepourl validator. The URL is subsequently written verbatim into .git/config by configurerepo(pull=False). This issue has been patched in version 5.17.1.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41654?
CVE-2026-41654 is classified as a high-severity vulnerability due to its potential exploitation by authenticated users.
How do I fix CVE-2026-41654?
To fix CVE-2026-41654, upgrade Weblate to version 5.17.1 or later.
Who is affected by CVE-2026-41654?
CVE-2026-41654 affects authenticated users with `project.add` permission on hosted Weblate SaaS.
What types of attacks can exploit CVE-2026-41654?
CVE-2026-41654 can be exploited by importing a crafted project backup ZIP that contains an attacker-chosen private repo URL.
What permissions are required to exploit CVE-2026-41654?
Exploitation of CVE-2026-41654 requires a user to have `project.add` permissions.