Read the docs
TI-2026-25832 Aliases CVE-2026-33435GHSA-558g-h753-6m33

Weblate: Remote code execution during backup restoration

Priority LOW 38CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00708 53rd percentileScored 2026-11-07
Fix Fixed weblate (WeblateOrg): 5.17Weblate (PyPI): 5.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WeblateOrgweblatebefore 5.175.17Patch availableCNA
—Weblate (PyPI)before 5.175.17Patch availableGHSA-558g-h753-6m33
  • weblate VendorWeblateOrg Affected before 5.17 Fixed in 5.17 Patch available CNA
  • Weblate (PyPI) Vendor— Affected before 5.17 Fixed in 5.17 Patch available GHSA-558g-h753-6m33

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*before 5.17VulnerableWeblateOrg
  • cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:* Versions before 5.17 Vulnerable ·WeblateOrg

Remediation

  • Fix · CNA weblate (WeblateOrg) Fixed in 5.17
  • Fix · GHSA-558g-h753-6m33 Weblate (PyPI) Fixed in 5.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33435
  2. 2026-10-03 Alias added: GHSA-558g-h753-6m33

References

Patch 1

Advisory 2

Other 2

  • TI-2025-23145 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext CVSS 3.1HIGH 7.5
  • TI-2025-38033 Weblate integration with Anubis can lead to Open Redirect via redir parameter CVSS 4.0LOW 2.1
  • TI-2022-07893 Remote code execution (RCE) in Weblate CVSS 3.1HIGH 8.8
  • TI-2025-41967 Weblate has git config file overwrite vulnerability that leads to remote code execution CVSS 3.1CRITICAL 9.1
  • TI-2026-26679 Weblate: Privilege escalation in the user API endpoint CVSS 3.1HIGH 8.8
  • TI-2026-19444 Weblate has an argument injection in management console CVSS 3.1CRITICAL 9.1
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences