CVE-2025-68398

Katalog CVE

CVSS 9.1 · Critical EPSS 0,79%

Kerentanan Improper Input Validation pada weblate. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

Rincian

Terbit di NVD

18 Desember 2025

Terakhir diubah

30 September 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3 advisory vendor
• https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
• https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
• https://github.com/WeblateOrg/weblate/pull/17330 issue tracking
• https://github.com/WeblateOrg/weblate/pull/17345 issue tracking
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1 release notes