weblate (PyPI)
Advisories
75
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2026.7 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "weblate>=2026.7"poetry
poetry add "weblate>=2026.7"uv
uv add "weblate>=2026.7"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2q2q-jr9g-v9rf Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project |
High EPSS 0.45% |
< 2026.7 | 2026.7 |
| GHSA-2q2q-jr9g-v9rf Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project |
High EPSS 0.45% |
< 2026.7 | 2026.7 |
| GHSA-2p9g-x3cv-5hh4 Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups |
Medium EPSS 0.32% |
< 2026.7 | 2026.7 |
| GHSA-2p9g-x3cv-5hh4 Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups |
Medium EPSS 0.32% |
< 2026.7 | 2026.7 |
| GHSA-vmfc-9982-2m45 Weblate SSRF: outbound URL guard misses some private ranges |
Medium EPSS 0.31% |
>= 5.15, < 2026.6 | 2026.6 |
| GHSA-vmfc-9982-2m45 Weblate SSRF: outbound URL guard misses some private ranges |
Medium EPSS 0.31% |
>= 5.15, < 2026.6 | 2026.6 |
| GHSA-6wxc-8mgq-w26m Weblate: Stored HTML injection in editor search preview |
Medium EPSS 0.21% |
< 2026.5 | 2026.5 |
| GHSA-6wxc-8mgq-w26m Weblate: Stored HTML injection in editor search preview |
Medium EPSS 0.21% |
< 2026.5 | 2026.5 |
| GHSA-5cmv-3rc4-7279 Weblate vulnerable to XSS via crafted Markdown |
Medium EPSS 0.27% |
< 5.17.1 | 5.17.1 |
| GHSA-5cmv-3rc4-7279 Weblate vulnerable to XSS via crafted Markdown |
Medium EPSS 0.27% |
< 5.17.1 | 5.17.1 |
| GHSA-gcg5-86jr-f7jg Weblate Vulnerable to Private Translation Enumeration via Screenshot API |
Medium EPSS 0.34% |
< 5.17.1 | 5.17.1 |
| GHSA-gcg5-86jr-f7jg Weblate Vulnerable to Private Translation Enumeration via Screenshot API |
Medium EPSS 0.34% |
< 5.17.1 | 5.17.1 |
| GHSA-cwcx-382v-8m9g Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url |
High EPSS 0.37% |
< 5.17.1 | 5.17.1 |
| GHSA-cwcx-382v-8m9g Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url |
High EPSS 0.37% |
< 5.17.1 | 5.17.1 |
| GHSA-6j8j-4qp3-36p2 Weblate Doesn't Invalidate API Token on Password Change |
Medium EPSS 0.27% |
< 5.17.1 | 5.17.1 |
| GHSA-6j8j-4qp3-36p2 Weblate Doesn't Invalidate API Token on Password Change |
Medium EPSS 0.27% |
< 5.17.1 | 5.17.1 |
| GHSA-ffgh-3jrf-8wvh Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision |
Medium EPSS 0.32% |
< 5.17 | 5.17 |
| GHSA-ffgh-3jrf-8wvh Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision |
Medium EPSS 0.32% |
< 5.17 | 5.17 |
| GHSA-f8hv-g549-hwg2 Weblate: SSRF via the webhook add-on using unprotected fetch_url() |
Medium EPSS 0.27% |
< 5.17 | 5.17 |
| GHSA-f8hv-g549-hwg2 Weblate: SSRF via the webhook add-on using unprotected fetch_url() |
Medium EPSS 0.27% |
< 5.17 | 5.17 |
| GHSA-3382-gw9x-477v Weblate: Privilege escalation in the user API endpoint |
High EPSS 0.39% |
< 5.17 | 5.17 |
| GHSA-3382-gw9x-477v Weblate: Privilege escalation in the user API endpoint |
High EPSS 0.39% |
< 5.17 | 5.17 |
| GHSA-xrwr-fcw6-fmq8 Weblate: SSRF via Project-Level Machinery Configuration |
Medium EPSS 0.25% |
< 5.17 | 5.17 |
| GHSA-xrwr-fcw6-fmq8 Weblate: SSRF via Project-Level Machinery Configuration |
Medium EPSS 0.25% |
< 5.17 | 5.17 |
| GHSA-hv99-mxm5-q397 Weblate: Arbitrary File Read via Symlink |
High EPSS 0.46% |
< 5.17 | 5.17 |
| GHSA-hv99-mxm5-q397 Weblate: Arbitrary File Read via Symlink |
High EPSS 0.46% |
< 5.17 | 5.17 |
| GHSA-5fhx-9jwj-867m Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads |
Medium EPSS 0.24% |
< 5.17 | 5.17 |
| GHSA-5fhx-9jwj-867m Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads |
Medium EPSS 0.24% |
< 5.17 | 5.17 |
| GHSA-558g-h753-6m33 Weblate: Remote code execution during backup restoration |
High EPSS 0.71% |
< 5.17 | 5.17 |
| GHSA-558g-h753-6m33 Weblate: Remote code execution during backup restoration |
High EPSS 0.71% |
< 5.17 | 5.17 |
| GHSA-mqph-7h49-hqfm Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository |
Medium EPSS 0.32% |
< 5.17 | 5.17 |
| GHSA-mqph-7h49-hqfm Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository |
Medium EPSS 0.32% |
< 5.17 | 5.17 |
| GHSA-mpf5-3vph-q75r Weblate: Improper access control for the translation memory in API |
Medium EPSS 0.24% |
< 5.17 | 5.17 |
| GHSA-mpf5-3vph-q75r Weblate: Improper access control for the translation memory in API |
Medium EPSS 0.24% |
< 5.17 | 5.17 |
| GHSA-vj45-x3pj-f4w4 Weblate: Improper access control for pending tasks in API |
Low EPSS 0.22% |
< 5.17 | 5.17 |
| GHSA-vj45-x3pj-f4w4 Weblate: Improper access control for pending tasks in API |
Low EPSS 0.22% |
< 5.17 | 5.17 |
| GHSA-wppc-7cq7-cgfv Weblate: Missing access control for the AddonViewSet API exposes all addon configurations |
Medium EPSS 0.35% |
< 5.16.1 | 5.16.1 |
| GHSA-wppc-7cq7-cgfv Weblate: Missing access control for the AddonViewSet API exposes all addon configurations |
Medium EPSS 0.35% |
< 5.16.1 | 5.16.1 |
| GHSA-33fm-6gp7-4p47 Weblate has an argument injection in management console |
Critical EPSS 0.52% |
< 5.16.0 | 5.16.0 |
| GHSA-33fm-6gp7-4p47 Weblate has an argument injection in management console |
Critical EPSS 0.52% |
< 5.16 | 5.16 |
| GHSA-3g2f-4rjg-9385 Weblate leaks information via screenshots |
High EPSS 0.39% |
< 5.15.2 | 5.15.2 |
| GHSA-3g2f-4rjg-9385 Weblate leaks information via screenshots |
High EPSS 0.39% |
< 5.15.2 | 5.15.2 |
| GHSA-8vcg-cfxj-p5m3 Weblate is vulnerable to RCE through Git config file overwrite |
Critical EPSS 0.79% |
< 5.15.1 | 5.15.1 |
| GHSA-8vcg-cfxj-p5m3 Weblate is vulnerable to RCE through Git config file overwrite |
Critical EPSS 0.79% |
< 5.15.1 | 5.15.1 |
| GHSA-g925-f788-4jh7 Weblate has an arbitrary file read via symbolic links |
Medium EPSS 0.41% |
< 5.15.1 | 5.15.1 |
| GHSA-g925-f788-4jh7 Weblate has an arbitrary file read via symbolic links |
Medium EPSS 0.41% |
< 5.15.1 | 5.15.1 |
| GHSA-hfpv-mc5v-p9mm Weblate has a Server-Side Request Forgery issue |
Medium EPSS 0.24% |
< 5.15 | 5.15 |
| GHSA-hfpv-mc5v-p9mm Weblate has a Server-Side Request Forgery issue |
Medium EPSS 0.24% |
< 5.15 | 5.15 |
| GHSA-3pmh-24wp-xpf4 Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) |
Medium EPSS 0.27% |
< 5.15 | 5.15 |
| GHSA-3pmh-24wp-xpf4 Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) |
Medium EPSS 0.27% |
< 5.15 | 5.15 |
| GHSA-pj86-258h-qrvf Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration |
Medium EPSS 0.26% |
< 5.15 | 5.15 |
| GHSA-pj86-258h-qrvf Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration |
Medium EPSS 0.26% |
< 5.15 | 5.15 |
| GHSA-m6hq-f4w9-qrjj Weblate has improper validation upon invitation acceptance |
Critical EPSS 0.35% |
< 5.15 | 5.15 |
| GHSA-m6hq-f4w9-qrjj Weblate has improper validation upon invitation acceptance |
Critical EPSS 0.35% |
< 5.15 | 5.15 |
| GHSA-gr35-vpx2-qxhc Weblate leaks the IP of project member inviting user to be reviewer in Audit log |
Low EPSS 0.20% |
< 5.14.1 | 5.14.1 |
| GHSA-gr35-vpx2-qxhc Weblate leaks the IP of project member inviting user to be reviewer in Audit log |
Low EPSS 0.20% |
< 5.14.1 | 5.14.1 |
| PYSEC-2025-269 Weblate is a web based localization tool. |
Low EPSS 0.39% |
< 5.13.3 | 5.13.3 |
| GHSA-377j-wj38-4728 Weblate has a long session expiry when verifying second factor |
Medium EPSS 0.29% |
< 5.13.1 | 5.13.1 |
| GHSA-377j-wj38-4728 Weblate has a long session expiry when verifying second factor |
Medium EPSS 0.29% |
< 5.13.1 | 5.13.1 |
| GHSA-4qqf-9m5c-w2c5 Weblate exposes personal IP address via e-mail |
Medium EPSS 0.32% |
< 5.12 | 5.12 |
| GHSA-4qqf-9m5c-w2c5 Weblate exposes personal IP address via e-mail |
Medium EPSS 0.32% |
< 5.12 | 5.12 |
| GHSA-57jg-m997-cx3q Weblate lacks rate limiting when verifying second factor |
Medium EPSS 0.27% |
< 5.12 | 5.12 |
| GHSA-57jg-m997-cx3q Weblate lacks rate limiting when verifying second factor |
Medium EPSS 0.27% |
< 5.12 | 5.12 |
| GHSA-m67m-3p5g-cw9j VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext |
High EPSS 0.38% |
< 5.11 | 5.11 |
| GHSA-m67m-3p5g-cw9j VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext |
High EPSS 0.38% |
< 5.11 | 5.11 |
| GHSA-jfgp-674x-6q4p Weblate vulnerable to improper sanitization of project backups |
Medium EPSS 0.32% |
>= 4.14, < 5.6.2 | 5.6.2 |
| GHSA-jfgp-674x-6q4p Weblate vulnerable to improper sanitization of project backups |
Medium EPSS 0.32% |
>= 4.14, < 5.6.2 | 5.6.2 |
| GHSA-3872-f48p-pxqj Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate |
High EPSS 3.10% |
< 4.11.1 | 4.11.1 |
| GHSA-3872-f48p-pxqj Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate |
High EPSS 3.10% |
< 4.11.1 | 4.11.1 |
| GHSA-3872-f48p-pxqj Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate |
High EPSS 3.10% |
< 4.11.1 | 4.11.1 |
| GHSA-3872-f48p-pxqj Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate |
High EPSS 3.10% |
< 4.11.1 | 4.11.1 |
| GHSA-6jp6-9rf9-gc66 Cross-site Scripting in Weblate |
Medium EPSS 0.75% |
< 4.11 | 4.11 |
| GHSA-6jp6-9rf9-gc66 Cross-site Scripting in Weblate |
Medium EPSS 0.75% |
< 4.11 | 4.11 |
| GHSA-j24g-gm76-j829 Weblate user account enumeration via reset password form |
Medium EPSS 2.31% |
< 2.10.1 | 2.10.1 |
| GHSA-j24g-gm76-j829 Weblate user account enumeration via reset password form |
Medium EPSS 2.31% |
< 2.10.1 | 2.10.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor