PT-2026-53661 · Libretranslate · Libretranslate

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-57942

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get remote address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.

Exploit

Correção

Enumeração de Fraquezas

CWE-348

Identificadores relacionados

CVE-2026-57942

Produtos afetados

Libretranslate

Referências · 5

• 🔥 https://github.com/LibreTranslate/LibreTranslate/issues/986 · Exploit
• https://github.com/LibreTranslate/LibreTranslate/pull/987 · Nota
• https://github.com/LibreTranslate/LibreTranslate/commit/397fd224080515d4001a1bc60c8fed53e3c56b6f · Correção
• https://vulncheck.com/advisories/libretranslate-ip-spoofing-via-x-forwarded-for-header · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57942 · Nota de Segurança