Read the docs
TI-2025-23145 Aliases CVE-2025-32021GHSA-m67m-3p5g-cw9j

Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

Priority HIGH 66CWE-598Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code repository URL contains GitHub credentials, the confidential PAT and username are shown in plaintext and get saved into browser history. Moreover, if the request URL is logged, the credentials are written to logs in plaintext. If using Weblate official Docker image, nginx logs the URL and the token in plaintext. This issue is patched in version 5.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed weblate (WeblateOrg): 5.11weblate (PyPI): 5.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WeblateOrgweblatebefore 5.115.11Patch availableCNA
—weblate (PyPI)before 5.115.11Patch availableGHSA-m67m-3p5g-cw9j
  • weblate VendorWeblateOrg Affected before 5.11 Fixed in 5.11 Patch available CNA
  • weblate (PyPI) Vendor— Affected before 5.11 Fixed in 5.11 Patch available GHSA-m67m-3p5g-cw9j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*before 5.11VulnerableWeblateOrg
  • cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:* Versions before 5.11 Vulnerable ·WeblateOrg

Remediation

  • Fix · CNA weblate (WeblateOrg) Fixed in 5.11
  • Fix · GHSA-m67m-3p5g-cw9j weblate (PyPI) Fixed in 5.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32021
  2. 2026-10-03 Alias added: GHSA-m67m-3p5g-cw9j

References

Exploit 1

Advisory 1

Other 2

  • TI-2025-38033 Weblate integration with Anubis can lead to Open Redirect via redir parameter CVSS 4.0LOW 2.1
  • TI-2022-07893 Remote code execution (RCE) in Weblate CVSS 3.1HIGH 8.8
  • TI-2025-41967 Weblate has git config file overwrite vulnerability that leads to remote code execution CVSS 3.1CRITICAL 9.1
  • TI-2026-26679 Weblate: Privilege escalation in the user API endpoint CVSS 3.1HIGH 8.8
  • TI-2026-19444 Weblate has an argument injection in management console CVSS 3.1CRITICAL 9.1
  • TI-2026-25832 Weblate: Remote code execution during backup restoration CVSS 3.1HIGH 8.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences