GitHub Advisoryadvisory · PyPI

GHSA-3g2f-4rjg-9385 Weblate leaks information via screenshots

LOW Published 2026-01-14 Modified 2026-01-14 Official page ↗
Aliases
CVE-2026-21889
Ecosystem
PyPI
Packages
weblate
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Weaknesses
CWE-284
Reviewed
2026-01-14

Affected packages

• PyPI weblate: < 5.15.2 → fixed in 5.15.2

Description

Impact The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. Patches • https://github.com/WeblateOrg/weblate/pull/17516 References Thanks to Lukas May and Michael Leu for reporting this.

Related

Alias · CVE (1)

  • CVE-2026-21889 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References