PT-2026-33116 · Weblate · Weblate

CVE-2026-33435 · Published 2026-04-15 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description Project backup fails to filter Git and Mercurial configuration files, which could lead to remote code execution under certain circumstances.

Recommendations Update to version 5.17. Restrict access to the project backup to limit the scope of the issue, as this feature is only accessible to users with project creation privileges.

Exploit

Fix

Relative Path Traversal

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-23

CWE-434

CWE-94

Related Identifiers

CVE-2026-33435

GHSA-558G-H753-6M33

PYSEC-2026-154

Affected Products

Weblate

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33435.json · Exploit
• https://github.com/WeblateOrg/weblate/pull/18549 · Patch
• https://osv.dev/vulnerability/GHSA-558g-h753-6m33 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33435 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33435 · Security Note
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-154.yaml · Note
• https://twitter.com/CVEnew/status/2044737941717622911 · Twitter Post