| Package | Affected versions | Patched versions |
|---|---|---|
| weblate | ≥ 4.14, < 5.6.2 | 5.6.2 |
| weblate | ≥ 4.14, < 5.6.2 | 5.6.2 |
Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file.
This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd.
Do not allow project creation to untrusted users.
Thanks to Bryan Cahill for bringing this issue to our attention.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free