Em resumo
- CVE-2025-67492 é uma vulnerabilidade MÉDIO (CVSS 5.3) que afeta weblate, weblate (weblate).
- Chance de exploração nos próximos 30 dias (EPSS): 0.26%, maior que 17.1% das vulnerabilidades.
- Correção: atualize para 5.15 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | < 5.15
| 5.15
|
| weblate | < 5.15
| 5.15
|
Description
Impact
It was possible to trigger repository updates for many repositories via a crafted webhook payload.
Patches
Workarounds
Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
References
Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.
NVD description
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free