High
Weblate: Remote code execution during backup restoration
Type: advisorySources: OSV
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-33435
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 19:26 UTC · Revision 1
Source evidence
Weblate: Remote code execution during backup restoration
core-osv · Original sourcePublished 15 Apr 2026, 18:13 UTC
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
osv:CVE-2026-33435
Complete source record
{
"id": "b685df694ac96948523ff2c333346459e2dd6e9f35ba4d62a258c72d03056448",
"url": "https://osv.dev/vulnerability/CVE-2026-33435",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Weblate: Remote code execution during backup restoration",
"summary": "Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.",
"evidence": "osv:CVE-2026-33435",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-33435",
"aliases": [
"CVE-2026-33435",
"GHSA-558g-h753-6m33",
"PYSEC-2026-154"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/weblateorg/weblate",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1dd6ea9403d1f266d03e4537a91d6e57c5f6310f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.17"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"weblate-5.16.1",
"weblate-5.16",
"weblate-5.15.2",
"weblate-5.15.1",
"weblate-5.15",
"weblate-5.14.1",
"weblate-5.14",
"weblate-5.13.2",
"weblate-5.13.1",
"weblate-5.13",
"weblate-5.12.2",
"weblate-5.12.1",
"weblate-5.12",
"weblate-5.11.1",
"weblate-5.11",
"weblate-5.10.3",
"weblate-5.10.2",
"weblate-5.10.1",
"weblate-5.10",
"weblate-5.9.2",
"weblate-5.9.1",
"weblate-5.9",
"weblate-5.8.2",
"weblate-5.8.1",
"weblate-5.8",
"weblate-5.7.2",
"weblate-5.7.1",
"weblate-5.7",
"weblate-5.6.1",
"weblate-5.6",
"weblate-5.5.5",
"weblate-5.5.4",
"weblate-5.5.3",
"weblate-5.5.2",
"weblate-5.5.1",
"weblate-5.5",
"weblate-5.4",
"weblate-5.3",
"weblate-5.2.1",
"weblate-5.2",
"weblate-5.1.1",
"weblate-5.1",
"weblate-5.0.2",
"weblate-5.0.1",
"weblate-4.18.1",
"weblate-4.18",
"weblate-4.17",
"weblate-4.16.2",
"weblate-4.16.1",
"weblate-4.16",
"weblate-4.15.1",
"weblate-4.15",
"weblate-4.14.2",
"weblate-4.14.1",
"weblate-4.14",
"weblate-4.13.1",
"weblate-4.13",
"weblate-4.12.1",
"weblate-4.12",
"weblate-4.11.2",
"weblate-4.11.1",
"weblate-4.11",
"weblate-4.10.1",
"weblate-4.10",
"weblate-4.9.1",
"weblate-4.9",
"weblate-4.8.1",
"weblate-4.8",
"weblate-4.7.2",
"weblate-4.7.1",
"weblate-4.7",
"weblate-4.6",
"weblate-4.5.2",
"weblate-4.5.1",
"weblate-4.5",
"weblate-4.4.1",
"weblate-4.4",
"weblate-4.3.2",
"weblate-4.3.1",
"weblate-4.3",
"weblate-4.2.1",
"weblate-4.2",
"weblate-4.1.1",
"weblate-4.1",
"weblate-4.0.2",
"weblate-4.0.1",
"weblate-4.0",
"weblate-3.11.1",
"weblate-3.11",
"weblate-3.10.2",
"weblate-3.10.1",
"weblate-3.10",
"weblate-3.9.1",
"weblate-3.9",
"weblate-3.8",
"weblate-3.7.1",
"weblate-3.7",
"weblate-3.6.1",
"weblate-3.6",
"weblate-3.5.1",
"weblate-3.5",
"weblate-3.4",
"weblate-3.3",
"weblate-3.2.1",
"weblate-3.2",
"weblate-3.1.1",
"weblate-3.1",
"weblate-3.0.1",
"weblate-3.0",
"weblate-2.20",
"weblate-2.19.1",
"weblate-2.19",
"weblate-2.18",
"weblate-2.17",
"weblate-2.16",
"weblate-2.15",
"weblate-2.14.1",
"weblate-2.14",
"weblate-2.13.1",
"weblate-2.13",
"weblate-2.12",
"weblate-2.11",
"weblate-2.10",
"weblate-2.9",
"weblate-2.8",
"weblate-2.7",
"weblate-2.5",
"weblate-2.4",
"weblate-2.3",
"weblate-2.2",
"weblate-2.1",
"weblate-1.9",
"weblate-1.8",
"weblate-1.7",
"weblate-1.6",
"weblate-1.5",
"weblate-1.4",
"weblate-1.3",
"weblate-1.2",
"weblate-1.1",
"weblate-1.0",
"weblate-0.9",
"weblate-0.8",
"weblate-0.6",
"weblate-0.5",
"weblate-0.3",
"weblate-0.2",
"weblate-0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33435.json"
}
}
],
"modified": "2026-10-28T02:30:22.614509097Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33435.json",
"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33",
"https://nvd.nist.gov/vuln/detail/CVE-2026-33435",
"https://github.com/WeblateOrg/weblate/pull/18549"
],
"provider_metadata": {
"cwe_ids": [
"CWE-23",
"CWE-434",
"CWE-94"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33435.json"
}
},
"related_cves": [
{
"value": "CVE-2026-33435",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489118,
"published_at": "2026-04-15T18:13:07.568+00:00"
}