CVEvulnerability

CVE-2026-34242

7.7 HIGH Published 2026-04-15 Modified 2026-10-26 Official page ↗

Status: Analyzed
Published: 2026-04-15
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses: CWE-200, CWE-22, CWE-59

Description

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

Affected configurations

• weblate weblate (< 5.17)

Weakness · CWE (3)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
CWE-59 Improper Link Resolution Before File Access weakness

References

https://github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3 Patch
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hv99-mxm5-q397 Third Party Advisory

CVE-2026-34242

Description

Affected configurations

Related

Weakness · CWE (3)

References