CVE-2026-61792: Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Weblate user with project-administrator privileges can exploit it. The issue affects access through the App store metadata download feature.
What access does an attacker need, and is user interaction required?
The attacker needs project-administrator privileges but does not need another user to interact with a malicious request. The supplied vector indicates network-reachable exploitation with low attack complexity.
What can a successful exploit expose?
A successful exploit can disclose the contents of files on the Weblate host outside the affected project's repository. The provided impact data indicates high confidentiality impact, with no stated integrity or availability impact.
Which versions are affected and what is the remediation?
Weblate versions before 2026.7 are affected. Upgrade to version 2026.7, which fixes the incomplete path-traversal remediation.