CVE-2025-68398

Summary

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

Affected Software

Weaknesses

• CWE-20: CWE-20: Improper Input Validation
• CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-434: CWE-434: Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
• https://github.com/WeblateOrg/weblate/pull/17330
• https://github.com/WeblateOrg/weblate/pull/17345
• https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
• https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1

• ←Previous
• Next→