weblateorg/weblate · Security
Weblate SSRF: outbound URL guard misses some private ranges
- GHSA ID
- GHSA-vmfc-9982-2m45
- CVE ID
- CVE-2026-50127
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Impact
Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.
Patches
Resources
The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.
CWEs
- CWE-918 · Server-Side Request Forgery (SSRF)