CVE-2024-39303CWE-73

Weblate vulnerabler to improper sanitization of project backups

Medium · published July 1, 2024

CVSS v3.1
4.4
EPSS
0%
Percentile
23.5
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.5th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2024-07-01T18:46Z
EPSS history
Timeline
  • 01 JUL 18:46Z
    Weblate vulnerabler to improper sanitization of project backups
    cvelistv5