# CVE-2026-33440: Weblate SSRF via redirect bypass in screenshot URL uploads

Source: https://junglewise.ai/threats/cve-2026-33440-weblate-ssrf-via-redirect-bypass-in-screenshot-url-uploads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-15. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-33440 · Severity: medium · CVSS 5 · Published 2026-04-15

Weblate, a web-based translation tool, is vulnerable to a security flaw where an authenticated user can bypass domain restrictions when uploading screenshots via a URL. By using a malicious redirect, an attacker could force the server to make requests to internal systems or restricted domains. This could lead to the exposure of sensitive internal information or unauthorized access to internal network services.

Technologies: [weblate (PyPI)](https://junglewise.ai/threats/technologies/weblate), [Weblate](https://junglewise.ai/threats/technologies/weblate-weblate). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Weblate](https://junglewise.ai/threats/vendors/weblate).

## Quick answers

**Is CVE-2026-33440 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33440 being exploited in the wild.

**How severe is CVE-2026-33440?** Medium severity, with a CVSS score of 5, published 15 April 2026.

**Which products and versions are affected?** weblate (PyPI) < 5.17, ECOSYSTEM:introduced=0,fixed=5.17.

**Is there a fix for CVE-2026-33440?** Yes. weblate (PyPI): upgrade to 5.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33440 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33440?** Check whether you run weblate (PyPI) or Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- weblate (PyPI): upgrade to 5.17 or later

  ```sh
  pip install "weblate>=5.17"
  ```


## Technical details

An authenticated Server-Side Request Forgery (SSRF) exists in Weblate's screenshot URL upload functionality. The 'ALLOWED_ASSET_DOMAINS' setting, intended to restrict the domains from which assets can be fetched, only validates the initial request URL and fails to account for HTTP redirects. An attacker with low privileges can provide a URL pointing to a controlled server that redirects to a restricted internal resource or a domain not in the allowlist. This allows the attacker to bypass security controls and potentially access internal metadata services or other sensitive internal network endpoints. The issue is fixed in version 5.17.

## Affected products

- WeblateOrg weblate < 5.17

## Identifiers

- CVE-2026-33440
- GHSA-5fhx-9jwj-867m
- PYSEC-2026-2312

## Timeline

- 2026-04-15: disclosed
- 2026-04-15: patched
- 2026-04-16: advisory

## References

- [https://api.github.com/users/spbavarva](https://api.github.com/users/spbavarva)
- [https://github.com/spbavarva](https://github.com/spbavarva)
- [https://api.github.com/users/spbavarva/gists%7B/gist_id%7D](https://api.github.com/users/spbavarva/gists%7B/gist_id%7D)
- [https://api.github.com/users/spbavarva/repos](https://api.github.com/users/spbavarva/repos)
- [https://avatars.githubusercontent.com/u/84507631?v=4](https://avatars.githubusercontent.com/u/84507631?v=4)
- [https://api.github.com/users/spbavarva/events%7B/privacy%7D](https://api.github.com/users/spbavarva/events%7B/privacy%7D)

## Related threats

- [Weblate argument injection in Mercurial backend](https://junglewise.ai/threats/cve-2026-86035-weblate-is-a-web-based-continuous-localization-platform-used-to)
- [Weblate IDOR in GroupViewSet authorization bypass](https://junglewise.ai/threats/cve-2026-55228-weblate-idor-in-groupviewset-authorization-bypass)
- [Weblate observable object existence disclosure via HTTP status codes](https://junglewise.ai/threats/cve-2026-55227-weblate-observable-object-existence-disclosure-via-http-status)
- [PYSEC-2026-2037 - Weblate leaks information via screenshots](https://junglewise.ai/threats/cve-2026-21889-weblate-information-disclosure-via-unprotected-screenshots)
- [PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic links](https://junglewise.ai/threats/cve-2025-68279-weblate-has-an-arbitrary-file-read-via-symbolic-links)