CVE-2026-33220CWE-200CWE-22

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

Medium · published April 15, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-15T18:03Z
EPSS history
Timeline
  • 15 APR 18:03Z
    Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
    cvelistv5