CVE-2026-61792 in Weblate
Summary
by MITRE • 08/27/2026
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified as CVE-2026-34242 represents a critical path traversal flaw within Weblate, a widely adopted web-based continuous localization platform designed to manage software translations and multilingual content workflows. This specific issue stems from an incomplete remediation of a previously disclosed security defect, highlighting the risks associated with partial patches that fail to address all attack vectors in complex application logic. The core technical failure resides in the App store metadata download feature, which is intended to facilitate the retrieval of configuration or extension data for projects managed within the platform. In versions prior to 2026.7, this functionality does not adequately sanitize or constrain file paths provided by users with project administrator privileges. Specifically, the application resolves attacker-influenced input paths without enforcing strict confinement to the designated repository directory structure. This lack of proper path normalization allows an authenticated user operating at the project-administrator level to construct malicious requests that traverse upward through the server's filesystem hierarchy using standard directory traversal sequences such as dot-dot-slash patterns.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The flaw occurs because the application logic trusts user-supplied path components during the metadata download process without sufficiently validating that the resolved absolute path remains within the expected project root directory. By manipulating these input parameters, an attacker can bypass intended access controls and read arbitrary files from the underlying Weblate host operating system. This capability effectively neutralizes the security boundary between the web application environment and the broader server infrastructure. The persistence of this vulnerability in versions preceding 2026.7 indicates that earlier mitigation attempts were insufficient, likely due to an oversight in handling edge cases or alternative path resolution mechanisms within the codebase. Such incomplete fixes are particularly dangerous as they may create a false sense of security while leaving critical data exposure risks intact.
The operational impact of this vulnerability is significant for organizations relying on Weblate for sensitive localization projects. An attacker with project-administrator privileges can exploit this flaw to disclose confidential files residing outside the project repository. This could include configuration files containing database credentials, API keys, private cryptographic certificates, or internal source code from other projects hosted on the same instance. The ability to read arbitrary host files expands the attack surface considerably, potentially leading to further compromise of the underlying system if sensitive information is leveraged for subsequent attacks such as credential stuffing or privilege escalation. This aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries probe the local file system to gather intelligence necessary for lateral movement or data exfiltration. The severity is compounded by the fact that project administrators are often trusted users within an organization, meaning the attack vector requires a lower level of initial compromise compared to unauthenticated attacks, yet still poses a severe risk to data confidentiality and integrity.
To mitigate this vulnerability, organizations must immediately upgrade their Weblate instances to version 2026.7 or later, where the path traversal logic has been properly corrected to enforce strict directory confinement for all file operations within the App store metadata download feature. Until an upgrade is feasible, administrators should review access controls and consider restricting project-administrator privileges to only those users who strictly require them, thereby reducing the number of potential attackers capable of exploiting this flaw. Additionally, implementing a Web Application Firewall with rules specifically designed to detect and block path traversal sequences in request parameters can provide a temporary layer of defense against exploitation attempts. Regular security audits and penetration testing should be conducted on localization platforms to ensure that partial patches do not leave residual vulnerabilities open for exploitation by malicious insiders or compromised accounts.