Description
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Affected products
weblate: weblate
References6
- github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfx… Vendor Advisory
- github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398a…
- github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd…
- github.com/WeblateOrg/weblate/pull/17330 Issue Tracking
- github.com/WeblateOrg/weblate/pull/17345 Issue Tracking
- github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1 Release Notes
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - EPSS — exploit probability
- 1% percentile: 57 · as of 11 November 2026
- CWE
- CWE-20CWE-22CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.