VulnerabilityAnalyzed

CVE-2026-34242

Weblate is a web based localization tool.

HIGH 7.7EPSS 0.46%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS: 0.46% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-59, CWE-200
Affected: weblate/weblate
Source: security-advisories@github.com

References

https://github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3Patch
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hv99-mxm5-q397Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.