GitHub Advisoryadvisory · PyPI

GHSA-558g-h753-6m33 Weblate: Remote code execution during backup restoration

HIGH Published 2026-04-16 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-33435
Ecosystem
PyPI
Packages
Weblate
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-23, CWE-434, CWE-94
Reviewed
2026-04-16

Affected packages

• PyPI Weblate: < 5.17 → fixed in 5.17

Description

Impact The project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances. Patches • https://github.com/WeblateOrg/weblate/pull/18549 Workarounds The project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability. References This issue was reported by ggamno via HackerOne.

Related

Alias · CVE (1)

  • CVE-2026-33435 Weblate is a web based localization tool. vulnerability

Weakness · CWE (3)

  • CWE-23 Relative Path Traversal weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-94 Improper Control of Generation of Code weakness

References