Weblate is vulnerable to RCE through Git config file overwrite

CRITICAL 9.1CVE-2025-68398 · GHSA-8vcg-cfxj-p5m3 · PYSEC-2026-571 · Published 18/12/2025 · updated 30/09/2026

Package	Affected versions	Patched versions
weblate PyPI	`< 5.15.1`	`5.15.1`
weblate weblate	`< 5.15.1`	`5.15.1`

Description

Impact

It was possible to overwrite Git configuration remotely and override some of its behavior.

Resources

Thanks to Jason Marcello for responsible disclosure.

NVD description

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

References

WeblateOrg/weblate security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-68398 · ADVISORY
WeblateOrg/weblate#17330 · WEB
WeblateOrg/weblate#17345 · WEB
WeblateOrg/weblate commit 4837a41 · WEB
WeblateOrg/weblate commit dd8c9d7 · WEB
WeblateOrg/weblate · PACKAGE
WeblateOrg/weblate release weblate-5.15.1 · WEB
pypi.org/project/weblate · PACKAGE
GitHub Advisory GHSA-8vcg-cfxj-p5m3 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free