CVE-2026-33435

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/WeblateOrg/weblate/pull/18549	Issue Tracking Patch
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Weblate es una herramienta de localización basada en web. En versiones anteriores a la 5.17, la copia de seguridad del proyecto no filtraba los archivos de configuración de Git y Mercurial, lo que podría llevar a la ejecución remota de código bajo ciertas circunstancias. Este problema ha sido solucionado en la versión 5.17. Si los desarrolladores no pueden actualizar inmediatamente, pueden limitar el alcance de la vulnerabilidad restringiendo el acceso a la copia de seguridad del proyecto, ya que solo es accesible para los usuarios que pueden crear proyectos.

Information

Published : 2026-04-15 19:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-33435

Mitre link : CVE-2026-33435

CVE.ORG link : CVE-2026-33435

JSON object : View

Products Affected

weblate

weblate

CWE

CWE-23

Relative Path Traversal

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2026-33435", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33435", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T18:40:18.548374Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WeblateOrg", "product": "weblate", "versions": [{"status": "affected", "version": "< 5.17"}]}]}], "published": "2026-04-15T19:16:35.277", "references": [{"url": "https://github.com/WeblateOrg/weblate/pull/18549", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-23"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects."}, {"lang": "es", "value": "Weblate es una herramienta de localizaci\u00f3n basada en web. En versiones anteriores a la 5.17, la copia de seguridad del proyecto no filtraba los archivos de configuraci\u00f3n de Git y Mercurial, lo que podr\u00eda llevar a la ejecuci\u00f3n remota de c\u00f3digo bajo ciertas circunstancias. Este problema ha sido solucionado en la versi\u00f3n 5.17. Si los desarrolladores no pueden actualizar inmediatamente, pueden limitar el alcance de la vulnerabilidad restringiendo el acceso a la copia de seguridad del proyecto, ya que solo es accesible para los usuarios que pueden crear proyectos."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64AD3B80-D39E-4EAF-9CF8-B4D3C8A6C58A", "versionEndExcluding": "5.17"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}