Executive brief
Weblate, a web-based translation tool, is vulnerable to a security flaw where an authenticated user can bypass domain restrictions when uploading screenshots via a URL. By using a malicious redirect, an attacker could force the server to make requests to internal systems or restricted domains. This could lead to the exposure of sensitive internal information or unauthorized access to internal network services.
Technical details
An authenticated Server-Side Request Forgery (SSRF) exists in Weblate's screenshot URL upload functionality. The 'ALLOWED_ASSET_DOMAINS' setting, intended to restrict the domains from which assets can be fetched, only validates the initial request URL and fails to account for HTTP redirects. An attacker with low privileges can provide a URL pointing to a controlled server that redirects to a restricted internal resource or a domain not in the allowlist. This allows the attacker to bypass security controls and potentially access internal metadata services or other sensitive internal network endpoints. The issue is fixed in version 5.17.
Affected products
- WeblateOrg weblate < 5.17
Timeline
- 2026-04-15: disclosed
- 2026-04-15: patched
- 2026-04-16: advisory