In breve
- CVE-2026-21889 è una vulnerabilità ALTO (CVSS 7.5) che riguarda weblate, weblate (weblate).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.39%, superiore al 32.8% delle vulnerabilità.
- Correzione: aggiornare a 5.15.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15.2
| 5.15.2
|
| weblate | < 5.15.2
| 5.15.2
|
Description
Impact
The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Patches
References
Thanks to Lukas May and Michael Leu for reporting this.
NVD description
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free