Executive brief
Weblate is a web-based translation management platform used by organizations to coordinate software localization workflows. A project administrator can exploit a path traversal vulnerability in the App store metadata download feature to read arbitrary files on the server outside the project's repository. This allows disclosure of sensitive system files and configuration data that should not be accessible to project administrators.
Technical details
The vulnerability is a path traversal flaw in Weblate's App store metadata download feature that inadequately confines file path resolution to the repository boundary. This is an incomplete fix for CVE-2026-34242, where the original patch failed to fully prevent attacker-controlled paths from escaping the repository directory. A project administrator can craft requests to the metadata download endpoint that resolve to files outside the intended scope. The attack requires project-administrator privileges and no network traversal is needed since the attacker is an authenticated admin. The fix in version 2026.7 adds symlink validation to prevent symbolic links from resolving outside the component root directory.
Affected products
- Weblate Weblate prior to 2026.7
Timeline
- 2026-08-26: disclosed
- 2026-06-24: patched: Version 2026.7 fixes the vulnerability