CVE-2026-34242

Katalog CVE

CVSS 7.7 · High EPSS 0,53%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada weblate. Skor CVSS 3.1 7.7 (High) menurut github.com.

Deskripsi (NVD)

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3 patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hv99-mxm5-q397 advisory pihak ketiga