Weblate — CraftedSignal Threat Feed

Weblate Improper Privilege Management via API Endpoint (CVE-2026-34393)

hello@craftedsignal.io — Thu, 16 Apr 2026 12:00:00 +0000

Weblate, a web-based localization tool, contains an improper privilege management vulnerability (CVE-2026-34393) affecting versions prior to 5.17. The vulnerability lies in the user patching API endpoint, which doesn’t adequately restrict the scope of edits allowed. An attacker with low privileges could potentially exploit this flaw to modify data or settings beyond their authorized permissions. This issue was reported and patched in Weblate version 5.17. Successful exploitation can lead to data integrity issues, unauthorized access to sensitive information, and potentially, complete compromise of the Weblate instance.

Attack Chain

Attacker authenticates to Weblate with a low-privileged user account.
Attacker identifies the user patching API endpoint (e.g., /api/users/).
Attacker crafts a malicious API request to modify attributes of a different user account, potentially an administrator.
The attacker submits the request to the vulnerable API endpoint, exploiting the lack of proper scope validation.
The Weblate server processes the request without correctly verifying the attacker’s authorization to modify the target user’s attributes.
The target user’s attributes are modified according to the attacker’s request, potentially elevating the attacker’s privileges or compromising the target user’s account.
The attacker leverages the elevated privileges to access sensitive data or perform unauthorized actions within the Weblate system.
Attacker maintains persistent access by creating new admin accounts or backdoors within the Weblate system.

Impact

Successful exploitation of CVE-2026-34393 can lead to significant data breaches, unauthorized modifications, and complete compromise of the Weblate instance. An attacker could gain administrative access, modify translations, and potentially inject malicious content into localized software. The number of affected installations is currently unknown, but any Weblate instance running a version prior to 5.17 is vulnerable. Organizations that rely on Weblate for their localization workflows are at risk.

Recommendation

Immediately upgrade Weblate to version 5.17 or later to patch CVE-2026-34393.
Monitor Weblate’s web server logs for suspicious API requests targeting the user patching endpoint (/api/users/) as described in the Attack Chain (use the Sigma rule provided below).
Review user account permissions and audit logs for any unexpected privilege escalations.
Implement stricter input validation and authorization checks within the Weblate application to prevent similar vulnerabilities in the future.
Deploy the Sigma rule provided below to your SIEM to detect exploitation attempts.

Weblate Project Backup Vulnerability Leads to Potential Remote Code Execution (CVE-2026-33435)

hello@craftedsignal.io — Wed, 15 Apr 2026 19:16:35 +0000

Weblate, a web-based localization tool, contains a vulnerability (CVE-2026-33435) in versions prior to 5.17. The flaw stems from the project backup functionality, which fails to adequately filter Git and Mercurial configuration files. This oversight can be exploited to achieve remote code execution (RCE) under certain circumstances. The vulnerability was reported and patched in version 5.17. Mitigation steps for unpatched systems involve restricting access to the project backup feature, as it is limited to users with project creation privileges. This vulnerability poses a significant risk, as successful exploitation can lead to complete system compromise, data breaches, and further malicious activities.

Attack Chain

An attacker gains access to a Weblate account with project creation privileges.
The attacker creates a malicious project containing crafted Git or Mercurial configuration files.
The attacker triggers a project backup.
The backup process fails to properly sanitize the malicious configuration files.
The backup is stored on the server, potentially overwriting existing files.
The Weblate server attempts to process or utilize the tainted configuration files.
Due to improper sanitization, the malicious configuration files trigger command execution within the Weblate server’s environment.
The attacker achieves remote code execution, gaining control over the Weblate server.

Impact

Successful exploitation of CVE-2026-33435 can lead to remote code execution on the Weblate server. The impact includes potential data breaches, unauthorized access to localization projects, and complete compromise of the affected system. While the exact number of affected installations is unknown, organizations using vulnerable versions of Weblate risk significant operational disruption and data loss. Sectors utilizing Weblate for localization, such as software development, content creation, and e-commerce, are at increased risk.

Recommendation

Upgrade Weblate to version 5.17 or later to patch CVE-2026-33435.
If upgrading is not immediately feasible, restrict access to the project backup feature to only trusted users as recommended in the CVE description.
Monitor web server logs for unusual activity related to project backup downloads, focusing on requests to /admin/backup/ paths. Use the provided Sigma rule to detect unusual file downloads from the webserver.
Implement the provided Sigma rule to detect suspicious file uploads of git configuration files.

Weblate Path Traversal Vulnerability in ZIP Download Feature (CVE-2026-34242)

hello@craftedsignal.io — Wed, 15 Apr 2026 19:16:35 +0000

Weblate, a web-based localization tool, has a path traversal vulnerability (CVE-2026-34242) affecting versions prior to 5.17. The vulnerability exists within the ZIP download feature, where the application fails to adequately verify downloaded files. This can allow an attacker to craft a malicious ZIP archive containing symbolic links that, when extracted by a user or the application itself, can lead to files outside of the intended repository being accessed. The vulnerability was reported and patched in version 5.17. Exploitation of this vulnerability requires a user to download and extract a maliciously crafted ZIP file.

Attack Chain

Attacker identifies a Weblate instance running a version prior to 5.17.
Attacker gains access to a translation project, either legitimately (e.g., as a translator) or illegitimately (e.g., via compromised credentials or another vulnerability).
Attacker crafts a malicious ZIP archive containing symbolic links that point to sensitive files or directories outside the intended Weblate repository (e.g., /etc/passwd, application configuration files).
Attacker uploads the malicious ZIP archive to the Weblate project, potentially disguised as a legitimate translation file.
A user (e.g., an administrator or another translator) downloads the ZIP archive using the ZIP download feature.
The user extracts the ZIP archive on their local machine or, if Weblate automatically processes the ZIP, on the server.
The symbolic links within the extracted archive are resolved, potentially allowing access to sensitive files or directories outside the Weblate repository.
Attacker gains unauthorized access to sensitive information, potentially leading to further compromise of the system.

Impact

Successful exploitation of this path traversal vulnerability (CVE-2026-34242) can allow an attacker to read arbitrary files on the server where Weblate is installed or on a user’s machine if the user downloads and extracts the crafted ZIP archive locally. This could lead to the exposure of sensitive information such as application configuration files, database credentials, or even system-level files, depending on the permissions of the user or the Weblate application. The severity is rated as HIGH with a CVSS v3.1 score of 7.7.

Recommendation

Upgrade Weblate to version 5.17 or later to patch CVE-2026-34242 (reference: Overview).
Implement file integrity monitoring on Weblate servers to detect unauthorized file access (reference: Attack Chain - step 7).
Deploy the Sigma rule to detect ZIP archive downloads containing suspicious filenames that might indicate path traversal attempts (reference: rules).
Educate users about the risks of downloading and extracting files from untrusted sources (reference: Overview).