| Package | Affected versions | Patched versions |
|---|---|---|
| weblate | ≥ 5.15, < 2026.6 | 2026.6 |
Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.
The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free