En bref
- CVE-2026-33435 est une vulnérabilité ÉLEVÉE (CVSS 8.0) touchant weblate, weblate (weblate).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.71%, plus élevée que 53.5% des vulnérabilités.
- Correctif : mettre à jour vers 5.17 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.17
| 5.17
|
| weblate | < 5.17
| 5.17
|
Description
Impact
The project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances.
Patches
Workarounds
The project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability.
References
This issue was reported by ggamno via HackerOne.
NVD description
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free