CVE-2026-86035 in Weblate
Summary
by MITRE • 09/29/2026
Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
Weblate serves as a critical web-based continuous localization platform, enabling development teams to manage software translations efficiently through its integrated interface. Within this ecosystem, the Mercurial backend plays a pivotal role in synchronizing translation files with source code repositories managed by the Mercurial version control system. A significant security flaw was identified in Weblate versions ranging from 4.11.1 up to 2026.7.1, specifically involving an argument injection vulnerability within this Mercurial integration layer. This vulnerability stems from improper validation of repository filenames provided by the user or configuration settings. When a repository filename begins with a hyphen character, the underlying system fails to distinguish between command-line options and literal file paths. Consequently, these leading hyphens are interpreted as flags for the Mercurial executable rather than part of the directory structure, creating an avenue for malicious input manipulation.
The operational impact of this vulnerability is severe due to its potential for remote code execution under specific conditions. An authenticated user possessing project-scoped component.edit permissions can exploit this flaw by configuring a Mercurial-backed RESX component and utilizing the Update RESX files add-on. By carefully crafting repository paths that start with hyphens, an attacker can inject arbitrary arguments into the Mercurial command line. If a subsequent update to the repository is triggered through the platform's automated processes or manual actions, these injected arguments are passed directly to the operating system shell executing the Mercurial commands. This results in the execution of arbitrary commands with the privileges associated with the Weblate service account, effectively granting the attacker control over the server environment hosting the localization platform.
This issue is classified as a residual incomplete fix for CVE-2022-23915, indicating that previous remediation efforts failed to fully address the root cause of argument injection in this specific context. The persistence of this flaw highlights the complexity of securing applications that interact with external command-line tools and version control systems. From a classification perspective, this vulnerability aligns with CWE-78, which covers Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. Furthermore, it maps to MITRE ATT&CK technique T1059, specifically sub-techniques related to command and script interpreters, where attackers leverage legitimate system utilities to execute malicious payloads without deploying additional malware binaries.
To mitigate this risk, organizations running Weblate must immediately upgrade to version 2026.8 or later, which contains the corrected code that properly sanitizes repository filenames before passing them to the Mercurial executable. For environments where an immediate upgrade is not feasible, administrators should enforce strict input validation on all fields related to repository paths and restrict component.edit permissions to only those users who absolutely require it. Additionally, running the Weblate service with minimal necessary privileges can help limit the blast radius of any potential exploitation attempts. Regular audits of configuration settings and continuous monitoring for unusual command executions in system logs are recommended practices to detect and respond to such vulnerabilities proactively.