Em resumo
- CVE-2026-50127 é uma vulnerabilidade MÉDIO (CVSS 5.9) que afeta weblate.
- Chance de exploração nos próximos 30 dias (EPSS): 0.31%, maior que 23.7% das vulnerabilidades.
- Correção: atualize para 2026.6 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| weblate PyPI | ≥ 5.15, < 2026.6
| 2026.6
|
Description
Impact
Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.
Patches
Resources
The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.
NVD description
Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free