Is CVE-2026-21889 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21889 being exploited in the wild.

How severe is CVE-2026-21889?

Medium severity, with a CVSS score of 4, published 7 July 2026.

Which products and versions are affected?

weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.15.2.

Is there a fix for CVE-2026-21889?

Yes. weblate (PyPI): upgrade to 5.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21889 attacked?

It is attacked over the network.

Am I affected by CVE-2026-21889?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21889: PYSEC-2026-2037 - Weblate leaks information via screenshots

CVE-2026-21889 · Severity: medium · CVSS 4 · Published 2026-07-07

Weblate is a web-based translation management platform used by organizations to manage multilingual content. Screenshots uploaded to the system were accessible directly from the web server without proper access controls, allowing unauthenticated attackers to view sensitive images by guessing their filenames. This could expose confidential translation work, customer data, or other sensitive information stored in screenshots.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-21889 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21889 being exploited in the wild.
How severe is CVE-2026-21889?: Medium severity, with a CVSS score of 4, published 7 July 2026.
Which products and versions are affected?: weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.15.2.
Is there a fix for CVE-2026-21889?: Yes. weblate (PyPI): upgrade to 5.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21889 attacked?: It is attacked over the network.
Am I affected by CVE-2026-21889?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 5.15.2 or later
```
pip install "weblate>=5.15.2"
```

Technical details

The vulnerability is an improper access control issue (CWE-284) in Weblate's screenshot handling. Screenshot images stored on the HTTP server were served without authentication or authorization checks, allowing unauthenticated users to access them by guessing or brute-forcing filenames. While the attack requires low privileges (login to generate valid screenshot references) and high attack complexity (guessing valid filenames), an attacker can achieve confidentiality impact by accessing sensitive screenshots. The patch is available in version 5.15.2 and pull request #17516.

Affected products

Weblate Weblate before 5.15.2

Identifiers

CVE-2026-21889
GHSA-3g2f-4rjg-9385
PYSEC-2026-2037

Timeline

2026-01-14: disclosed
2026-01-14: patched: Fixed in version 5.15.2

References

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.