GitHub Advisoryadvisory · PyPI

GHSA-jfgp-674x-6q4p Weblate vulnerable to improper sanitization of project backups

LOW Published 2024-07-01 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-39303
Ecosystem
PyPI
Packages
Weblate
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-73
Reviewed
2024-07-01

Affected packages

• PyPI Weblate: >= 4.14, < 5.6.2 → fixed in 5.6.2

Description

Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. Patches This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd. Workarounds Do not allow project creation to untrusted users. References Thanks to Bryan Cahill for bringing this issue to our attention. For more information If you have any questions or comments about this advisory: • Open a topic in discussions • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2024-39303 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-73 External Control of File Name or Path weakness

References