Executive brief
Weblate is a web-based translation management platform used by organizations to manage multilingual content. Screenshots uploaded to the system were accessible directly from the web server without proper access controls, allowing unauthenticated attackers to view sensitive images by guessing their filenames. This could expose confidential translation work, customer data, or other sensitive information stored in screenshots.
Technical details
The vulnerability is an improper access control issue (CWE-284) in Weblate's screenshot handling. Screenshot images stored on the HTTP server were served without authentication or authorization checks, allowing unauthenticated users to access them by guessing or brute-forcing filenames. While the attack requires low privileges (login to generate valid screenshot references) and high attack complexity (guessing valid filenames), an attacker can achieve confidentiality impact by accessing sensitive screenshots. The patch is available in version 5.15.2 and pull request #17516.
Affected products
- Weblate Weblate before 5.15.2
Timeline
- 2026-01-14: disclosed
- 2026-01-14: patched: Fixed in version 5.15.2