Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

CAO 8.1CVE-2026-41654 · GHSA-cwcx-382v-8m9g · PYSEC-2026-2317 · Công bố 07/05/2026 · cập nhật 25/10/2026

Tóm tắt nhanh

CVE-2026-41654 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng weblate, weblate (weblate).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.37%, cao hơn 31.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.17.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
weblate PyPI	`< 5.17.1`	`5.17.1`
weblate weblate	`< 5.17.1`	`5.17.1`

Mô tả

Impact

An authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False).

Patches

Workarounds

Limiting who can create projects limits the scope.

Resources

Weblate thanks @fg0x0 for reporting this vulnerability via GitHub.

Mô tả của NVD

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.