Is CVE-2026-86035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86035 being exploited in the wild.

How severe is CVE-2026-86035?

High severity, with a CVSS score of 8.5, published 29 September 2026.

Which products and versions are affected?

Weblate 4.11.1 through 2026.7.1.

Is there a fix for CVE-2026-86035?

A patch was published on 2026-08: Fixed in version 2026.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86035 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86035?

Check whether you run Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86035: Weblate argument injection in Mercurial backend

CVE-2026-86035 · Severity: high · CVSS 8.5 · Published 2026-09-29

Weblate is a web-based platform for managing software translations across multiple languages. A flaw in how it handles Mercurial repository names allows an authenticated user to inject malicious Mercurial options through specially-crafted filenames, potentially leading to arbitrary command execution on the server hosting Weblate.

Technologies: Weblate. Vendors: Weblate.

Quick answers

Is CVE-2026-86035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86035 being exploited in the wild.
How severe is CVE-2026-86035?: High severity, with a CVSS score of 8.5, published 29 September 2026.
Which products and versions are affected?: Weblate 4.11.1 through 2026.7.1.
Is there a fix for CVE-2026-86035?: A patch was published on 2026-08: Fixed in version 2026.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86035 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86035?: Check whether you run Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An argument-injection vulnerability exists in Weblate's Mercurial backend (versions 4.11.1 through 2026.7.1) where repository filenames beginning with a hyphen are misinterpreted as Mercurial command options rather than literal paths. An authenticated user with component.edit permission can exploit this via a Mercurial-backed RESX component using the Update RESX files add-on, causing arbitrary command execution with Weblate service account privileges upon repository update. The vulnerability is a residual incomplete fix for CVE-2022-23915, patched in version 2026.8.

Affected products

Weblate Weblate 4.11.1 through 2026.7.1

Timeline

2026-09-29: disclosed
2026-08: patched: Fixed in version 2026.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.