PT-2026-33116 · Weblate · Weblate

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-33435

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description Project backup fails to filter Git and Mercurial configuration files, which could lead to remote code execution under certain circumstances.

Recommendations Update to version 5.17. Restrict access to the project backup to limit the scope of the issue, as this feature is only accessible to users with project creation privileges.

Fix

Code Injection

Relative Path Traversal

Unrestricted File Upload

Weakness Enumeration

CWE-94

CWE-23

CWE-434

Related Identifiers

CVE-2026-33435

GHSA-558G-H753-6M33

PYSEC-2026-154

Affected Products

Weblate

References · 7

• https://github.com/WeblateOrg/weblate/pull/18549 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33435 · Security Note
• https://osv.dev/vulnerability/GHSA-558g-h753-6m33 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33 · Note
• https://twitter.com/CVEnew/status/2044737941717622911 · Twitter Post