CVE-2026-34244

Katalog CVE

CVSS 5.0 · Medium EPSS 0,33%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada weblate. Skor CVSS 3.1 5.0 (Medium) menurut github.com.

Deskripsi (NVD)

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.

Rincian

Terbit di NVD

15 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WeblateOrg/weblate/commit/e619e9090202e4886b844c110d39308e7e882c0e patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8 advisory pihak ketiga