CVE-2026-34242CWE-200CWE-22CWE-59

Weblate: Arbitrary File Read via Symlink

High · published April 15, 2026

CVSS v3.1
7.7
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-04-15T18:19Z
EPSS history
Timeline
  • 15 APR 18:19Z
    Weblate: Arbitrary File Read via Symlink
    cvelistv5