CVE-2026-34242
Symlink Traversal in Weblate ZIP Download Allows File Access
Publication date: 2026-04-15
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| weblate | weblate | to 5.17 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized actors to perform arbitrary file reads via symlinks, potentially exposing sensitive information without user interaction.
Such exposure of sensitive data can lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require strict controls to prevent unauthorized access to personal or protected health information.
Therefore, until fixed, this vulnerability could result in violations of confidentiality requirements mandated by these regulations.
Can you explain this vulnerability to me?
CVE-2026-34242 is a high-severity vulnerability affecting Weblate versions prior to 5.17, specifically in the ZIP download feature.
The vulnerability occurs because the ZIP download feature does not properly verify downloaded files and can follow symbolic links (symlinks) that point outside the intended repository directory.
This improper handling allows an attacker to perform an arbitrary file read via symlink, potentially exposing sensitive information without requiring user interaction.
- CWE-22 (Path Traversal): The product uses external input to construct file paths but fails to neutralize special path elements, allowing resolution outside the restricted directory.
- CWE-59 (Link Following): The product does not prevent filenames from resolving to symlinks or shortcuts that lead to unintended resources.
- CWE-200 (Exposure of Sensitive Information): Unauthorized actors can access sensitive data due to the above flaws.
How can this vulnerability impact me? :
This vulnerability can lead to a high loss of confidentiality by allowing attackers to read arbitrary files outside the intended repository.
Attackers can exploit this issue remotely over the network with low complexity and low privileges, without any user interaction.
The impact is limited to confidentiality loss; there is no impact on data integrity or system availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the ZIP download feature in Weblate versions prior to 5.17 improperly following symbolic links outside the repository, which can lead to arbitrary file reads.
To detect this vulnerability on your system, you should first verify the version of Weblate you are running. If it is prior to 5.17, your system is potentially vulnerable.
- Check Weblate version by running: `weblate --version` or checking the version in your deployment configuration.
- Inspect ZIP download directories for unexpected symbolic links that point outside the intended repository path. You can use commands like `find /path/to/weblate/repository -type l -ls` to list symbolic links.
- Monitor network traffic for suspicious ZIP download requests that might exploit this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Weblate to version 5.17 or later, where the vulnerability has been fixed by tightening symlink validation in the ZIP download feature.
- Upgrade Weblate to version 5.17 or newer.
- If immediate upgrade is not possible, restrict access to the ZIP download feature or disable it temporarily to prevent exploitation.
- Audit and remove any symbolic links in the repository directories that could be exploited.
- Monitor logs for unusual access patterns related to ZIP downloads.