# CVE-2026-86035: Weblate argument injection in Mercurial backend

Source: https://junglewise.ai/threats/cve-2026-86035-weblate-is-a-web-based-continuous-localization-platform-used-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-86035 · Severity: high · CVSS 8.5 · Published 2026-09-29

Weblate is a web-based platform for managing software translations across multiple languages. A flaw in how it handles Mercurial repository names allows an authenticated user to inject malicious Mercurial options through specially-crafted filenames, potentially leading to arbitrary command execution on the server hosting Weblate.

Technologies: [Weblate](https://junglewise.ai/threats/technologies/weblate-weblate). Vendors: [Weblate](https://junglewise.ai/threats/vendors/weblate).

## Quick answers

**Is CVE-2026-86035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86035 being exploited in the wild.

**How severe is CVE-2026-86035?** High severity, with a CVSS score of 8.5, published 29 September 2026.

**Which products and versions are affected?** Weblate 4.11.1 through 2026.7.1.

**Is there a fix for CVE-2026-86035?** A patch was published on 2026-08: Fixed in version 2026.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86035 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86035?** Check whether you run Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An argument-injection vulnerability exists in Weblate's Mercurial backend (versions 4.11.1 through 2026.7.1) where repository filenames beginning with a hyphen are misinterpreted as Mercurial command options rather than literal paths. An authenticated user with component.edit permission can exploit this via a Mercurial-backed RESX component using the Update RESX files add-on, causing arbitrary command execution with Weblate service account privileges upon repository update. The vulnerability is a residual incomplete fix for CVE-2022-23915, patched in version 2026.8.

## Affected products

- Weblate Weblate 4.11.1 through 2026.7.1

## Timeline

- 2026-09-29: disclosed
- 2026-08: patched: Fixed in version 2026.8

## References

- [https://github.com/WeblateOrg/weblate/commit/f60a9759a6d851bd10ccdefe9b1b7f0cdb9e9bbd](https://github.com/WeblateOrg/weblate/commit/f60a9759a6d851bd10ccdefe9b1b7f0cdb9e9bbd)
- [https://github.com/WeblateOrg/weblate/pull/20768](https://github.com/WeblateOrg/weblate/pull/20768)

## Related threats

- [Weblate path traversal via repository boundary check bypass](https://junglewise.ai/threats/cve-2026-40256-weblate-path-traversal-via-repository-boundary-check-bypass)
- [Weblate SSRF in webhook add-on via fetch_url](https://junglewise.ai/threats/cve-2026-39845-weblate-ssrf-in-webhook-add-on-via-fetch-url)
- [Weblate privilege escalation in user API endpoint](https://junglewise.ai/threats/cve-2026-34393-weblate-privilege-escalation-in-user-api-endpoint)
- [Weblate SSRF in Project-Level Machinery Configuration](https://junglewise.ai/threats/cve-2026-34244-weblate-ssrf-in-project-level-machinery-configuration)
- [Weblate arbitrary file read via symlink in ZIP download](https://junglewise.ai/threats/cve-2026-34242-weblate-arbitrary-file-read-via-symlink-in-zip-download)