# CVE-2026-61792: Weblate path traversal in App store metadata download

Source: https://junglewise.ai/threats/cve-2026-61792-weblate-path-traversal-in-app-store-metadata-download  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61792 · Severity: high · CVSS 7.7 · Published 2026-08-26

Weblate is a web-based translation management platform used by organizations to coordinate software localization workflows. A project administrator can exploit a path traversal vulnerability in the App store metadata download feature to read arbitrary files on the server outside the project's repository. This allows disclosure of sensitive system files and configuration data that should not be accessible to project administrators.

## Quick answers

**Is CVE-2026-61792 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61792 being exploited in the wild.

**How severe is CVE-2026-61792?** High severity, with a CVSS score of 7.7, published 26 August 2026.

**Which products and versions are affected?** Weblate Weblate prior to 2026.7.

**Is there a fix for CVE-2026-61792?** A patch was published on 2026-06-24: Version 2026.7 fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61792 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-61792?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in Weblate's App store metadata download feature that inadequately confines file path resolution to the repository boundary. This is an incomplete fix for CVE-2026-34242, where the original patch failed to fully prevent attacker-controlled paths from escaping the repository directory. A project administrator can craft requests to the metadata download endpoint that resolve to files outside the intended scope. The attack requires project-administrator privileges and no network traversal is needed since the attacker is an authenticated admin. The fix in version 2026.7 adds symlink validation to prevent symbolic links from resolving outside the component root directory.

## Affected products

- Weblate Weblate prior to 2026.7

## Timeline

- 2026-08-26: disclosed
- 2026-06-24: patched: Version 2026.7 fixes the vulnerability

## References

- [https://github.com/WeblateOrg/weblate/commit/299fb28315674ae3fb010e96031951cacfe367db](https://github.com/WeblateOrg/weblate/commit/299fb28315674ae3fb010e96031951cacfe367db)
- [https://github.com/WeblateOrg/weblate/commit/33a9acb5ad223a927a56ffd741bbddf28a54a5e3](https://github.com/WeblateOrg/weblate/commit/33a9acb5ad223a927a56ffd741bbddf28a54a5e3)