GitHub Advisoryadvisory · PyPI

GHSA-pj86-258h-qrvf Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

MEDIUM Published 2025-12-15 Modified 2026-06-08 Official page ↗
Aliases
CVE-2025-67492
Ecosystem
PyPI
Packages
Weblate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1286
Reviewed
2025-12-15

Affected packages

• PyPI Weblate: < 5.15 → fixed in 5.15

Description

Impact It was possible to trigger repository updates for many repositories via a crafted webhook payload. Patches • https://github.com/WeblateOrg/weblate/pull/17221 Workarounds Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability. References Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.

Related

Alias · CVE (1)

  • CVE-2025-67492 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-1286 Improper Validation of Syntactic Correctness of Input weakness

References