Compliance Impact

The provided information does not explicitly address how the vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41654 is a security vulnerability in Weblate, a web-based localization tool. Before version 5.17.1, an authenticated user with project.add permission could import a crafted project backup ZIP file containing a malicious repository URL. This URL could point to private addresses (e.g., http://127.0.0.1:9999/) or use non-allow-listed schemes (e.g., file://, git://).

The vulnerability arises because Weblate persists components using a method that bypasses Django's full validation, allowing the malicious URL to be written directly into the .git/config file. This improper validation could lead to unauthorized interactions with private or restricted resources.

The issue was fixed in version 5.17.1 by adding explicit validation of repository URLs during backup restoration and enforcing validation on remote operations in Git commands.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user with certain permissions to import project backups containing malicious repository URLs that point to private or restricted network addresses or use disallowed URL schemes.

Such an attack could lead to Server-Side Request Forgery (SSRF), potentially enabling unauthorized access to internal services or resources that are not normally accessible externally.

It may also compromise data integrity by manipulating the backup restoration process, possibly leading to unauthorized repository configurations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an attacker importing a crafted project backup ZIP file containing malicious repository URLs that bypass validation and are written into the .git/config file. Detection involves checking for unauthorized or suspicious repository URLs in project backup components and .git/config files.

You can detect this vulnerability by inspecting the repository URLs configured in your Weblate projects, especially those restored from backups. Look for URLs pointing to private addresses (e.g., http://127.0.0.1:9999/) or using non-allow-listed schemes such as file:// or git://.

Suggested commands to detect suspicious repository URLs include:

• Search for suspicious URLs in the .git/config files of your Weblate repositories: `grep -rE 'file://|git://|http://127\.0\.0\.1|http://localhost' /path/to/weblate/repos/*/.git/config`
• Check the components/<name>.json files inside project backup ZIPs before importing them for suspicious repo URLs: `unzip -p backup.zip components/* | grep -E 'file://|git://|http://127\.0\.0\.1|http://localhost'`
• Audit recent project backup imports and verify if any contain non-validated repository URLs.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade Weblate to version 5.17.1 or later, where the issue has been patched by enforcing validation of repository URLs during project backup restoration.

If upgrading immediately is not possible, consider the following workarounds:

• Restrict project creation and backup import permissions to trusted users only, limiting who can import project backups.
• Manually inspect and validate any project backup ZIP files before importing them to ensure they do not contain malicious repository URLs.
• Audit existing repositories for suspicious repository URLs and remove or correct any that point to private or non-allow-listed addresses.

Useful 0 Not Useful 0