In breve
- CVE-2025-67492 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda weblate, weblate (weblate).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.26%, superiore al 17.1% delle vulnerabilità.
- Correzione: aggiornare a 5.15 o successiva.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15
| 5.15
|
| weblate | < 5.15
| 5.15
|
Description
Impact
It was possible to trigger repository updates for many repositories via a crafted webhook payload.
Patches
Workarounds
Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
References
Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.
NVD description
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free