Impact

The user patching API endpoint didn't properly limit the scope of edits.

Patches https://github.com/WeblateOrg/weblate/pull/18687

References Thanks to @tikket1 and @DavidCarliez for reporting this via GitHub. We received two individual reports for this.

Impact The project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances.

Patches https://github.com/WeblateOrg/weblate/pull/18549

Workarounds The project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability.

References This issue was reported by ggamno via HackerOne.

Impact A user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read.

Patches

https://github.com/WeblateOrg/weblate/pull/18684 The solution then has been cleaned up in followup patches

Workarounds Limiting available machinery services via WEBLATEMACHINERY setting can avoid this.

References

Thanks to @DavidCarliez for disclosing this via GitHub private vulnerability reporting.

Impact The API for tasks didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope.

Patches https://github.com/WeblateOrg/weblate/pull/18515

Workarounds The attacker needs to guess the random UUID of the task, so exploiting this is unlikely with the default API rate limits.

References This issue was identified by Michal Čihař.

Impact The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.

Patches https://github.com/WeblateOrg/weblate/pull/18513

Workarounds Blocking access to /api/memory/ in the HTTP server removes access to this feature.

References This issue was reported by ggamno via HackerOne.

Impact The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.

Patches https://github.com/WeblateOrg/weblate/pull/18516

Workarounds The CDN add-on is not enabled by default.

References Thanks to @spbavarva for reporting this responsibly via GitHub.

Impact The ALLOWEDASSETDOMAINS setting applied only to the first issued requests and didn't restrict possible redirects.

Patches https://github.com/WeblateOrg/weblate/pull/18550

References This issue was reported by @spbavarva via GitHub.

Impact The webhook add-on did not utilize existing SSRF protection.

Patches https://github.com/WeblateOrg/weblate/pull/18815

Workarounds Disabling the add-on would avoid misusing this.

References Thanks to @Lihfdgjr for reporting this via GitHub.

Impact Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repooutside).

Patches https://github.com/WeblateOrg/weblate/pull/18847

References Thanks to m9nx4u for reporting this issue via HackerOne.

Impact

The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository.

Patches

https://github.com/WeblateOrg/weblate/pull/18683

References

Thanks to @DavidCarliez for reporting this vulnerability via GitHub.

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECTDOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site. The redirect can also be used to initiate drive-by downloads (redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.13.3.

Impact

It was possible to accept an invitation opened by a different Weblate user.

Patches

https://github.com/WeblateOrg/weblate/pull/16913

Workarounds

Users should avoid leaving Weblate sessions with an unattended opened invitation.

References

Thanks to Nahid0x for responsibly disclosing this vulnerability to Weblate.

Impact

It was possible to trigger repository updates for many repositories via a crafted webhook payload.

Patches

https://github.com/WeblateOrg/weblate/pull/17221

Workarounds

Disabling webhooks completely using ENABLEHOOKS avoids this vulnerability.

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.

Impact

It was possible to retrieve user notification settings or list all users via API.

Patches

https://github.com/WeblateOrg/weblate/pull/17256

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to Weblate.

Impact The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames.

When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application’s error messages clearly differentiate between files that exist and files that do not, revealing information about the server’s filesystem layout.

In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise.

Patches

This has been addressed in the Weblate 5.15 release.

https://github.com/WeblateOrg/weblate/pull/17103 https://github.com/WeblateOrg/weblate/pull/17102

Workarounds

Removing Mercurial from VCSBACKENDS avoids this vulnerability, as the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message.

References Thanks to Jason Marcello for responsible disclosure.

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.

Impact The verification of the second factor had too long a session expiry. The long session expiry could be used to circumvent rate limiting of the second factor.

Patches This issue has been addressed in Weblate 5.13.1 via https://github.com/WeblateOrg/weblate/pull/16002.

References Thanks to Nahid Hasan Limon for reporting this issue responsibly.

Impact

It was possible to overwrite Git configuration remotely and override some of its behavior.

Resources

Thanks to Jason Marcello for responsible disclosure.

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global permissions. As a result, a user who belongs to a team that enforces 2FA and grants a global permission still receives that global permission even without 2FA configured, while the same requirement is correctly applied to project-, component-, and workspace-scoped permissions. Such a user can act on the granted global permission, including reaching the site management interface at /manage/. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. Regular expressions supplied through the regex: quality check and regex placeholders are compiled during validation but later run against translation content in RegexCheck and PlaceholderCheck with no time limit, so a catastrophic-backtracking pattern like ^(a|aa)+$ can consume CPU indefinitely. Because Weblate re-runs these checks for every linked target unit in the same request when a source unit's flags change, a single edit can trigger sustained CPU-bound denial of service. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. The nested endpoints do not apply the component-level access checks enforced on the direct component views, so the requester can enumerate changes for components that should be hidden from them. The exposed data can include the restricted component's identity, translation and unit links, and change payload fields such as source or translated string content in the target, old, and details values. This issue is fixed in version 2026.7.

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404.

Patches https://github.com/WeblateOrg/weblate/pull/19971

References Thanks to Yaohui Wang for reporting this via GitHub.

Impact The API did not properly handle project- and workspace-scoped teams and allowed setting invalid configurations, including granting access to projects the user has no access to.

Patches https://github.com/WeblateOrg/weblate/pull/19970

References

Parts of this issue were independently reported by four reporters: @H3xV0rT3x via GitHub imhego via HackerOne v01demort via HackerOne b4nder via HackerOne

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations that permit anonymous access, this metadata can be retrieved without any authentication. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, though translated-string content is not included in the feed. Installations using private projects or restricted components are affected. This issue is fixed in version 2026.8.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCSRESTRICTPRIVATE=True are affected. This issue is fixed in version 2026.8.

Impact

Weblate's VCSRESTRICTPRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

Patches

https://github.com/WeblateOrg/weblate/pull/19768

Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.

Impact

The screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user.

Patches https://github.com/WeblateOrg/weblate/pull/19258

Acknowledgement Weblate thanks Luay for reporting this vulnerability according to the organization's security issues guideline.