PT-2026-33121 · Weblate · Weblate

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-34244

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description A user with the project.edit permission, granted by the per-project Administration role, can configure machine translation service URLs to point to arbitrary internal network addresses. During the validation of this configuration, the application performs an HTTP request to the specified URL and returns up to 200 characters of the response body within an error message. This allows for Server-Side Request Forgery (SSRF), which is a flaw where a server is tricked into making requests to an unintended location, combined with a partial response read.

Recommendations Update to version 5.17. Limit available machinery services via the WEBLATE MACHINERY setting.

Fix

Information Disclosure

SSRF

Weakness Enumeration

CWE-200

CWE-918

Related Identifiers

CVE-2026-34244

GHSA-XRWR-FCW6-FMQ8

Affected Products

Weblate

References · 7

• https://github.com/WeblateOrg/weblate/commit/e619e9090202e4886b844c110d39308e7e882c0e · Patch
• https://osv.dev/vulnerability/GHSA-xrwr-fcw6-fmq8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34244 · Security Note
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/18684 · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8 · Note
• https://twitter.com/CVEnew/status/2044737937586127062 · Twitter Post