Kurz gesagt
- CVE-2026-21889 ist eine Schwachstelle (HOCH (CVSS 7.5)) in weblate, weblate (weblate).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.39%, höher als bei 32.8% aller Schwachstellen.
- Abhilfe: auf 5.15.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15.2
| 5.15.2
|
| weblate | < 5.15.2
| 5.15.2
|
Description
Impact
The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Patches
References
Thanks to Lukas May and Michael Leu for reporting this.
NVD description
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free