Skip to content
Heist/ feed
Back to feed
High

Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Type: advisorySources: OSV

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-61792
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 22:25 UTC · Revision 1

Source evidence

Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

core-osv · Original source

Published 26 Aug 2026, 20:26 UTC

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.

osv:CVE-2026-61792
Complete source record
{
  "id": "b5a2e0a51e1fe6a2ebf3bacb62fd31cddeae7925470462d28925c29cac1d4546",
  "url": "https://osv.dev/vulnerability/CVE-2026-61792",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)",
    "summary": "Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.",
    "evidence": "osv:CVE-2026-61792",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-61792",
      "aliases": [
        "CVE-2026-61792",
        "GHSA-xwj4-fp82-r2rj"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/weblateorg/weblate",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "95ce13d4a441559a94387f5f5a198b3b4b4a0027"
                },
                {
                  "fixed": "299fb28315674ae3fb010e96031951cacfe367db"
                },
                {
                  "fixed": "33a9acb5ad223a927a56ffd741bbddf28a54a5e3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2026.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "299fb28315674ae3fb010e96031951cacfe367db"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "33a9acb5ad223a927a56ffd741bbddf28a54a5e3"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "weblate-2026.6",
            "weblate-2026.5",
            "weblate-5.17.1",
            "weblate-5.17",
            "weblate-5.16.1",
            "weblate-5.16",
            "weblate-5.15.2",
            "weblate-5.15.1",
            "weblate-5.15",
            "weblate-5.14.1",
            "weblate-5.14",
            "weblate-5.13.2",
            "weblate-5.13.1",
            "weblate-5.13",
            "weblate-5.12.2",
            "weblate-5.12.1",
            "weblate-5.12",
            "weblate-5.11.1",
            "weblate-5.11",
            "weblate-5.10.3",
            "weblate-5.10.2",
            "weblate-5.10.1",
            "weblate-5.10",
            "weblate-5.9.2",
            "weblate-5.9.1",
            "weblate-5.9",
            "weblate-5.8.2",
            "weblate-5.8.1",
            "weblate-5.8",
            "weblate-5.7.2",
            "weblate-5.7.1",
            "weblate-5.7",
            "weblate-5.6.1",
            "weblate-5.6",
            "weblate-5.5.5",
            "weblate-5.5.4",
            "weblate-5.5.3",
            "weblate-5.5.2",
            "weblate-5.5.1",
            "weblate-5.5",
            "weblate-5.4",
            "weblate-5.3",
            "weblate-5.2.1",
            "weblate-5.2",
            "weblate-5.1.1",
            "weblate-5.1",
            "weblate-5.0.2",
            "weblate-5.0.1",
            "weblate-4.18.1",
            "weblate-4.18",
            "weblate-4.17",
            "weblate-4.16.2",
            "weblate-4.16.1",
            "weblate-4.16",
            "weblate-4.15.1",
            "weblate-4.15",
            "weblate-4.14.2",
            "weblate-4.14.1",
            "weblate-4.14",
            "weblate-4.13.1",
            "weblate-4.13",
            "weblate-4.12.1",
            "weblate-4.12",
            "weblate-4.11.2",
            "weblate-4.11.1",
            "weblate-4.11",
            "weblate-4.10.1",
            "weblate-4.10",
            "weblate-4.9.1",
            "weblate-4.9",
            "weblate-4.8.1",
            "weblate-4.8",
            "weblate-4.7.2",
            "weblate-4.7.1",
            "weblate-4.7",
            "weblate-4.6",
            "weblate-4.5.2",
            "weblate-4.5.1",
            "weblate-4.5",
            "weblate-4.4.1",
            "weblate-4.4",
            "weblate-4.3.2",
            "weblate-4.3.1",
            "weblate-4.3",
            "weblate-4.2.1",
            "weblate-4.2",
            "weblate-4.1.1",
            "weblate-4.1",
            "weblate-4.0.2",
            "weblate-4.0.1",
            "weblate-4.0",
            "weblate-3.11.1",
            "weblate-3.11",
            "weblate-3.10.2",
            "weblate-3.10.1",
            "weblate-3.10",
            "weblate-3.9.1",
            "weblate-3.9",
            "weblate-3.8",
            "weblate-3.7.1",
            "weblate-3.7",
            "weblate-3.6.1",
            "weblate-3.6",
            "weblate-3.5.1",
            "weblate-3.5",
            "weblate-3.4",
            "weblate-3.3",
            "weblate-3.2.1",
            "weblate-3.2",
            "weblate-3.1.1",
            "weblate-3.1",
            "weblate-3.0.1",
            "weblate-3.0",
            "weblate-2.20",
            "weblate-2.19.1",
            "weblate-2.19",
            "weblate-2.18",
            "weblate-2.17",
            "weblate-2.16",
            "weblate-2.15",
            "weblate-2.14.1",
            "weblate-2.14",
            "weblate-2.13.1",
            "weblate-2.13",
            "weblate-2.12",
            "weblate-2.11",
            "weblate-2.10",
            "weblate-2.9",
            "weblate-2.8",
            "weblate-2.7",
            "weblate-2.5",
            "weblate-2.4",
            "weblate-2.3",
            "weblate-2.2",
            "weblate-2.1",
            "weblate-1.9",
            "weblate-1.8",
            "weblate-1.7",
            "weblate-1.6",
            "weblate-1.5",
            "weblate-1.4",
            "weblate-1.3",
            "weblate-1.2",
            "weblate-1.1",
            "weblate-1.0",
            "weblate-0.9",
            "weblate-0.8",
            "weblate-0.6",
            "weblate-0.5",
            "weblate-0.3",
            "weblate-0.2",
            "weblate-0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61792.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.863383027Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61792.json",
        "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xwj4-fp82-r2rj",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-61792",
        "https://github.com/WeblateOrg/weblate/commit/299fb28315674ae3fb010e96031951cacfe367db",
        "https://github.com/WeblateOrg/weblate/commit/33a9acb5ad223a927a56ffd741bbddf28a54a5e3"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22",
          "CWE-59",
          "CWE-693"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61792.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-61792",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490546,
  "published_at": "2026-08-26T20:26:27.81+00:00"
}