En bref
- CVE-2025-67492 est une vulnérabilité MOYENNE (CVSS 5.3) touchant weblate, weblate (weblate).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 17.1% des vulnérabilités.
- Correctif : mettre à jour vers 5.15 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15
| 5.15
|
| weblate | < 5.15
| 5.15
|
Description
Impact
It was possible to trigger repository updates for many repositories via a crafted webhook payload.
Patches
Workarounds
Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
References
Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.
NVD description
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free