CVE-2026-33435CWE-23CWE-434CWE-94

Weblate: Remote code execution during backup restoration

High · published April 15, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00880 · 58.7th percentile
Weaknesses
CWE-23 · Relative Path Traversal; CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-04-15T18:13Z
EPSS history
Timeline
  • 15 APR 18:13Z
    Weblate: Remote code execution during backup restoration
    cvelistv5