Upstream information
Description
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having important severity.
| CVSS detail | CNA (GitHub) | SUSE |
|---|---|---|
| Base Score | 8 | 8 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| Attack Vector | Network | Network |
| Attack Complexity | High | High |
| Privileges Required | High | High |
| User Interaction | None | None |
| Scope | Changed | Changed |
| Confidentiality Impact | High | High |
| Integrity Impact | High | High |
| Availability Impact | High | High |
| CVSSv3 Version | 3.1 | 3.1 |
| CVSS detail | SUSE |
|---|---|
| Base Score | 5.5 |
| Vector | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H |
| Attack Vector | Network |
| Attack Complexity | High |
| Attack Requirements | None |
| Privileges Required | High |
| User Interaction | None |
| Vulnerable System Confidentiality Impact | None |
| Vulnerable System Integrity Impact | None |
| Vulnerable System Availability Impact | None |
| Subsequent System Confidentiality Impact | High |
| Subsequent System Integrity Impact | High |
| Subsequent System Availability Impact | High |
| CVSSv4 Version | 4.0 |
SUSE Timeline for this CVE
CVE page created: Wed Apr 15 22:37:56 2026CVE page last modified: Fri Apr 17 20:09:11 2026