Executive Summary

CVE-2025-67492 is a vulnerability in Weblate versions prior to 5.15 where the system improperly validates the 'full_name' field in webhook payloads. This improper validation allows an attacker to send specially crafted webhook payloads that trigger repository updates for many repositories at once. The root cause is that the system uses the 'full_name' value without verifying its validity, leading to overly broad repository matching queries and potential misuse. The issue was fixed by adding validation checks to ensure the 'full_name' is neither blank nor malformed, preventing invalid or overly broad repository matching. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to trigger mass updates across multiple repositories via crafted webhook payloads without any privileges or user interaction. This can lead to unintended repository updates and component enumeration. The confidentiality impact is low, and there is no impact on integrity or availability. However, it could cause operational disruptions or exposure of repository information. [2]

Useful 0 Not Useful 0

Detection Guidance

Detection can focus on monitoring incoming webhook payloads to the Weblate server for malformed or suspicious 'full_name' fields that do not conform to the expected 'owner/repository' format. Since the vulnerability involves triggering repository updates via crafted webhook payloads, inspecting webhook request logs for unusual or unexpected payloads with empty, too short, or missing slashes in 'full_name' can help identify exploitation attempts. Specific commands are not provided in the resources, but network monitoring tools or log analysis commands (e.g., grep or similar on webhook logs) targeting 'full_name' fields could be used. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Weblate to version 5.15 or later, where the vulnerability is fixed. As a temporary workaround, disable webhooks completely by setting ENABLE_HOOKS to false in the configuration. This prevents webhook payloads from being processed and avoids the vulnerability until the upgrade can be performed. [2]

Useful 0 Not Useful 0