In short
- CVE-2026-33435 is a HIGH (CVSS 8.0) vulnerability affecting weblate, weblate (weblate).
- Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.5% of all vulnerabilities.
- Fix: update to 5.17 or later.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.17
| 5.17
|
| weblate | < 5.17
| 5.17
|
Description
Impact
The project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances.
Patches
Workarounds
The project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability.
References
This issue was reported by ggamno via HackerOne.
NVD description
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free