GitHub Advisoryadvisory · PyPI

GHSA-g925-f788-4jh7 Weblate has an arbitrary file read via symbolic links

HIGH Published 2025-12-18 Modified 2025-12-20 Official page ↗

Aliases: CVE-2025-68279
Ecosystem: PyPI
Packages: Weblate
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses: CWE-22, CWE-59
Reviewed: 2025-12-18

Affected packages

• PyPI Weblate: < 5.15.1 → fixed in 5.15.1

Description

Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure.

Alias · CVE (1)

CVE-2025-68279 Weblate is a web based localization tool. vulnerability

Weakness · CWE (2)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
CWE-59 Improper Link Resolution Before File Access weakness

References

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-g925-f788-4jh7 web
https://nvd.nist.gov/vuln/detail/CVE-2025-68279 advisory
https://github.com/WeblateOrg/weblate/pull/17331 web
https://github.com/WeblateOrg/weblate/pull/17356 web
https://github.com/WeblateOrg/weblate package
https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1 web