PT-2025-40305 · Weblate · Weblate

Mbiesiad · Published 2025-10-01 · Updated 2025-10-08 · CVE-2025-61587

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions 5.13.2 and below

Description Weblate is a web-based localization tool. An open redirect exists via the redir parameter on the '.within.website' endpoint when Weblate is configured with Anubis and REDIRECT DOMAINS is not set. An attacker can create a URL on the legitimate domain that redirects a victim to an attacker-controlled site. This redirect could also initiate drive-by downloads, posing a risk to end users.

Recommendations Update to version 5.13.3 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

CWE-1395

Related Identifiers

CVE-2025-61587

GHSA-3XHV-R4GX-XW99

OPENSUSE-SU-2025:15615-1

Affected Products

Weblate

References · 14

• 🔥 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61587.json · Exploit
• https://github.com/WeblateOrg/weblate/commit/ec3b900f8a52c5c992d9e7014f09397e159ac381 · Patch
• https://github.com/WeblateOrg/weblate/commit/6b3d73a310279b5630bca8cbd9ea0be28bc67b63 · Patch
• https://github.com/WeblateOrg/docker/commit/76518342f65b8af8c2b7f7c5d37f84813c1253a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-61587 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15615-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61587 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-61587 · Note
• https://t.me/cveNotify/137646 · Telegram Post
• https://t.me/CVEtracker/33889 · Telegram Post
• https://t.me/cveNotify/137554 · Telegram Post
• https://twitter.com/CVEnew/status/1973516509772181737 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1973640009849676027 · Twitter Post