Is CVE-2026-41654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41654 being exploited in the wild.

How severe is CVE-2026-41654?

High severity, with a CVSS score of 8.1, published 7 May 2026.

Which products and versions are affected?

weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.

Is there a fix for CVE-2026-41654?

Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41654 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41654?

Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41654: Weblate SSRF via crafted project backup import

CVE-2026-41654 · Severity: high · CVSS 8.1 · Published 2026-05-07

Weblate is a web-based platform used by organizations to manage software translation and localization. A security vulnerability in the project import feature allows authorized users to bypass safety checks and force the server to connect to internal or restricted network addresses. This could lead to the exposure of sensitive internal data or unauthorized access to private infrastructure.

Technologies: weblate (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-41654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41654 being exploited in the wild.
How severe is CVE-2026-41654?: High severity, with a CVSS score of 8.1, published 7 May 2026.
Which products and versions are affected?: weblate (PyPI) ECOSYSTEM:introduced=0,fixed=5.17.1.
Is there a fix for CVE-2026-41654?: Yes. weblate (PyPI): upgrade to 5.17.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41654 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41654?: Check whether you run weblate (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

weblate (PyPI): upgrade to 5.17.1 or later
```
pip install "weblate>=5.17.1"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Weblate's project backup restoration process. When importing a project ZIP, the application uses Django's 'bulk_create' method to persist component metadata from JSON files, which bypasses the 'full_clean()' method and the associated 'validate_repo_url' validator. An attacker with 'project.add' permissions can provide a crafted ZIP containing malicious repository URLs (e.g., pointing to 127.0.0.1 or using file:// schemes). These URLs are written verbatim to the .git/config file, allowing the attacker to probe internal services or access local files when the repository is subsequently initialized or updated. This issue is fixed in version 5.17.1 by explicitly revalidating VCS URLs during the backup validation phase.

Affected products

WeblateOrg Weblate < 5.17.1

Identifiers

CVE-2026-41654
GHSA-cwcx-382v-8m9g
PYSEC-2026-2317

Timeline

2026-04-17: patched: Fixes committed to main branch and tagged for 5.17.1 release.
2026-05-07: disclosed: CVE-2026-41654 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.