PT-2025-51337 · Weblate · Weblate

Published 2025-12-15 · Updated 2026-05-26 · CVE-2025-66407

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.15

Description Weblate is a web-based localization tool. The Create Component functionality allows authorized users to add new translation components by specifying a version control system and a source code repository URL. Prior to version 5.15, the repository URL field lacks validation and sanitization, enabling attackers to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When using the Mercurial version control system, Weblate exposes the full server-side HTTP response for the provided URL, creating a server-side request forgery (SSRF) primitive. This allows probing internal services and accessing their contents. The behavior also enables local file enumeration through file:// requests, revealing information about the server’s filesystem layout based on error messages. In cloud environments, this can lead to credential disclosure and full environment compromise by accessing internal-only endpoints like cloud metadata services.

Recommendations Versions prior to 5.15: Upgrade to version 5.15 or later. Versions prior to 5.15: As a workaround, remove Mercurial from VCS BACKENDS.

Exploit

Fix

CSRF

SSRF

Weakness Enumeration

CWE-352

CWE-918

Related Identifiers

CVE-2025-66407

GHSA-HFPV-MC5V-P9MM

PYSEC-2025-231

Affected Products

Weblate

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66407.json · Exploit
• https://github.com/WeblateOrg/weblate/pull/17103 · Patch
• https://github.com/WeblateOrg/weblate/pull/17102 · Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66407 · Security Note
• https://osv.dev/vulnerability/GHSA-hfpv-mc5v-p9mm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66407 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-231 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2025-231.yaml · Note
• https://twitter.com/CVEnew/status/2002857344691257445 · Twitter Post
• https://t.me/CVEtracker/39883 · Telegram Post