CVE-2026-61792

Received Received - Intake

Path Traversal in Weblate Prior to 2026.7

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-61792

Affected Vendors & Products

Vendor	Product	Version / Range
weblate	weblate	2026.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Weblate versions before 2026.7 have a vulnerability where a project administrator can read files outside their repository using the App store metadata download feature. The path traversal issue allows accessing files on the Weblate host that are not part of the project's repository. This is a partial fix for a previous CVE that was not fully resolved.

Detection Guidance

Detecting this vulnerability requires checking Weblate versions prior to 2026.7. Run the command: weblate --version to verify the installed version. If the output shows a version older than 2026.7, the system is vulnerable.

Impact Analysis

If you are a project administrator using Weblate versions prior to 2026.7, an attacker with administrator access could exploit this to read sensitive files on the Weblate server outside your project's repository. This could lead to unauthorized access to confidential data stored on the host system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Exposure of personal or health information outside intended repositories may result in data breaches and regulatory penalties.

Mitigation Strategies

Upgrade Weblate to version 2026.7 or later immediately. Remove project-administrator privileges from untrusted users until the upgrade is complete. Monitor file access logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-61792. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70