CVE-2025-67492
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| weblate | weblate | to 5.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1286 | The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67492 is a vulnerability in Weblate versions prior to 5.15 where the system improperly validates the 'full_name' field in webhook payloads. This improper validation allows an attacker to send specially crafted webhook payloads that trigger repository updates for many repositories at once. The root cause is that the system uses the 'full_name' value without verifying its validity, leading to overly broad repository matching queries and potential misuse. The issue was fixed by adding validation checks to ensure the 'full_name' is neither blank nor malformed, preventing invalid or overly broad repository matching. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to trigger mass updates across multiple repositories via crafted webhook payloads without any privileges or user interaction. This can lead to unintended repository updates and component enumeration. The confidentiality impact is low, and there is no impact on integrity or availability. However, it could cause operational disruptions or exposure of repository information. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can focus on monitoring incoming webhook payloads to the Weblate server for malformed or suspicious 'full_name' fields that do not conform to the expected 'owner/repository' format. Since the vulnerability involves triggering repository updates via crafted webhook payloads, inspecting webhook request logs for unusual or unexpected payloads with empty, too short, or missing slashes in 'full_name' can help identify exploitation attempts. Specific commands are not provided in the resources, but network monitoring tools or log analysis commands (e.g., grep or similar on webhook logs) targeting 'full_name' fields could be used. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Weblate to version 5.15 or later, where the vulnerability is fixed. As a temporary workaround, disable webhooks completely by setting ENABLE_HOOKS to false in the configuration. This prevents webhook payloads from being processed and avoids the vulnerability until the upgrade can be performed. [2]