En resumen
- CVE-2025-67492 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a weblate, weblate (weblate).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.26%, mayor que el 17.1% de las vulnerabilidades.
- Solución: actualizar a 5.15 o posterior.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15
| 5.15
|
| weblate | < 5.15
| 5.15
|
Description
Impact
It was possible to trigger repository updates for many repositories via a crafted webhook payload.
Patches
Workarounds
Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
References
Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.
NVD description
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free