요약
- CVE-2026-50127은(는) weblate에 영향을 주는 보통 (CVSS 5.9) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.31%, 전체 취약점의 23.7%보다 높음.
- 조치: 2026.6 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | ≥ 5.15, < 2026.6
| 2026.6
|
Description
Impact
Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.
Patches
Resources
The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.
NVD description
Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free