PT-2026-36816 · Weblate · Weblate

Fg0X0 · Published 2026-04-30 · Updated 2026-05-07 · CVE-2026-41654

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17.1

Description An authenticated user with project.add permission can import a specially crafted project backup ZIP file. If the components/<name>.json file within the ZIP contains a repo URL pointing to a private address or uses a non-allow-listed scheme (such as file:// or git://), the system fails to validate it. This occurs because the software uses the Component.objects.bulk create([component])[0] function, which bypasses the full clean() method and the validate repo url validator. Consequently, the malicious URL is written directly into the .git/config file by the configure repo(pull=False) function.

Recommendations Update to version 5.17.1. Limit the number of users who have permission to create projects to reduce the risk of exploitation.

Fix

RCE

SSRF

Weakness Enumeration

CWE-20

CWE-918

Related Identifiers

CVE-2026-41654

GHSA-CWCX-382V-8M9G

Affected Products

Weblate

References · 11

• https://github.com/WeblateOrg/weblate/pull/19061 · Patch
• https://github.com/WeblateOrg/weblate/pull/19062 · Patch
• https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0 · Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g · Vendor Advisory
• https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14 · Patch
• https://osv.dev/vulnerability/GHSA-cwcx-382v-8m9g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41654 · Security Note
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1 · Note
• https://reddit.com/r/VulnMatter/comments/1t3jriw/resumen_diario_de_vulnerabilidades_04052026 · Reddit Post
• https://t.me/CVEtracker/52995 · Telegram Post