VulnerabilityAnalyzed

CVE-2026-21889

This could allow an unauthenticated user to access screenshots after guessing their filename.

LOW 2.3EPSS 0.39%

Does this matter?

Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.

Description

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 33th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-284
Affected: weblate/weblate
Source: security-advisories@github.com

EPSS trend

EPSS 0.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47Patch
https://github.com/WeblateOrg/weblate/pull/17516Issue Tracking
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.