GitHub Advisoryadvisory · PyPI

GHSA-vmfc-9982-2m45 Weblate SSRF: outbound URL guard misses some private ranges

MEDIUM Published 2026-07-07 Modified 2026-07-07 Official page ↗
Aliases
CVE-2026-50127
Ecosystem
PyPI
Packages
weblate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2026-07-07

Affected packages

• PyPI weblate: >= 5.15, < 2026.6 → fixed in 2026.6

Description

Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. Patches • https://github.com/WeblateOrg/weblate/pull/19768 Resources The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

Related

Alias · CVE (1)

  • CVE-2026-50127 Weblate is a web based localization tool. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References