Executive brief
Weblate is a web-based platform for managing software translation workflows. Users with permission to manage repository URLs can trick Weblate into connecting to internal services by providing a hostname that initially resolves to a public address but later rebinds to a private one. This allows attackers to access internal translation repositories and potentially expose sensitive project data.
Technical details
The vulnerability is a server-side request forgery (SSRF) caused by a time-of-check-time-of-use (TOCTOU) race condition in VCS repository URL validation. Weblate validates repository hostnames by performing a DNS resolution in Python, but external VCS clients (Git, Mercurial, Subversion) perform a separate DNS lookup when actually connecting. An attacker-controlled hostname can initially resolve to a public IP to pass validation, then be re-pointed to an internal/private address before the VCS client connects. The attacker must have permission to create or edit component repository URLs and be able to trigger clone, fetch, push, or similar remote VCS operations. Exploitation is mitigated when VCS_RESTRICT_PRIVATE is enabled and untrusted hostnames are not permitted. The issue is fixed in version 2026.8 by pinning addresses at validation time into subsequent protected operations.
Affected products
- Weblate Weblate prior to 2026.8
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2026.8