1. Home
  2. CVE Database
  3. CVE-2024-39303
MEDIUM · 4.4

CVE-2024-39303

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on ...

Vulnerability Description

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

CVSS Score

4.4

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
WeblateWeblate>= 4.14, < 5.6.2

Related Weaknesses (CWE)

CWE-73

References

FAQ

What is CVE-2024-39303?

CVE-2024-39303 is a vulnerability with a CVSS score of 4.4 (MEDIUM). Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on ...

How severe is CVE-2024-39303?

CVE-2024-39303 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-39303?

Check the references section above for vendor advisories and patch information. Affected products include: Weblate Weblate.