En bref
- CVE-2026-21889 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant weblate, weblate (weblate).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.39%, plus élevée que 32.8% des vulnérabilités.
- Correctif : mettre à jour vers 5.15.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15.2
| 5.15.2
|
| weblate | < 5.15.2
| 5.15.2
|
Description
Impact
The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Patches
References
Thanks to Lukas May and Michael Leu for reporting this.
NVD description
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free