Vulnerability Description
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/WeblateOrg/weblate/commit/299fb28315674ae3fb010e96031951cacfe
- https://github.com/WeblateOrg/weblate/commit/33a9acb5ad223a927a56ffd741bbddf28a5
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xwj4-fp82-r2rj
FAQ
What is CVE-2026-61792?
CVE-2026-61792 is a vulnerability with a CVSS score of 7.7 (HIGH). Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the A...
How severe is CVE-2026-61792?
CVE-2026-61792 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61792?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.