weblateorg/weblate · Security
Weblate: Remote code execution during backup restoration
- GHSA ID
- GHSA-558g-h753-6m33
- CVE ID
- CVE-2026-33435
- Severity
- high
- Published
- Updated
- CVSS
- 8 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS v3
- 8 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Impact
The project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances.
Patches
Workarounds
The project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability.
References
This issue was reported by ggamno via HackerOne.
CWEs
- CWE-23 · Relative Path Traversal
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
- CWE-434 · Unrestricted Upload of File with Dangerous Type
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-33435 ↗
- https://github.com/WeblateOrg/weblate/pull/18549 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-154.yaml ↗
- https://github.com/advisories/GHSA-558g-h753-6m33 ↗