Executive brief
Weblate, a web-based translation and localization tool, is vulnerable to remote code execution during the project restoration process. An attacker with high-level privileges (sufficient to create projects) could upload a malicious backup containing specially crafted Git or Mercurial configuration files. If exploited, this allows the attacker to execute arbitrary commands on the server, potentially leading to a full system takeover or data theft.
Technical details
Weblate versions prior to 5.17 are vulnerable to Remote Code Execution (RCE) via the project backup restoration feature. The vulnerability stems from a failure to filter or neutralize dangerous Git and Mercurial configuration files within the backup archive (CWE-94, CWE-434). An attacker with high privileges (PR:H), such as the ability to create or manage projects, can upload a crafted backup file. During the restoration process, these configuration files can be leveraged to execute arbitrary code on the host system. The attack complexity is considered high (AC:H) as it requires specific conditions during restoration, and the scope is changed (S:C) because the exploit impacts the underlying operating system. This issue is addressed in Weblate 5.17.
Affected products
- WeblateOrg weblate < 5.17
Timeline
- 2026-04-15: disclosed
- 2026-04-15: advisory: NVD publication date
- 2026-04-16: patched: GitHub Advisory published and fix confirmed in version 5.17