CVE-2026-33435

Katalog CVE

CVSS 8.0 · High EPSS 0,88%

Kerentanan Relative Path Traversal pada weblate. Skor CVSS 3.1 8.0 (High) menurut github.com.

Deskripsi (NVD)

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WeblateOrg/weblate/pull/18549 issue tracking · patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33 advisory pihak ketiga