CVE-2024-39303
published 2024-07-01CVE-2024-39303: Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible…
PriorityP431medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.32%
22.2th percentile
Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| weblate | weblate | >= 4.14 < 5.6.2 | 5.6.2 |
| weblate | weblate | >= 4.14 < 5.6.2 | 5.6.2 |
| weblateorg | weblate | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Weblate vulnerable to improper sanitization of project backups
ghsa·2024-07-01
CVE-2024-39303 [LOW] CWE-73 Weblate vulnerable to improper sanitization of project backups
Weblate vulnerable to improper sanitization of project backups
### Impact
Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to
files on the server using a crafted ZIP file.
### Patches
This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd.
### Workarounds
Do not allow project creation to untrusted users.
### References
Thanks to Bryan Cahill for bringing this issue to our attention.
### For more information
If you have any questions or comments about this advisory:
* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)
* Email us at [[email protected]](mailto:[email protected])
OSV
Weblate vulnerable to improper sanitization of project backups
osv·2024-07-01
CVE-2024-39303 [LOW] Weblate vulnerable to improper sanitization of project backups
Weblate vulnerable to improper sanitization of project backups
### Impact
Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to
files on the server using a crafted ZIP file.
### Patches
This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd.
### Workarounds
Do not allow project creation to untrusted users.
### References
Thanks to Bryan Cahill for bringing this issue to our attention.
### For more information
If you have any questions or comments about this advisory:
* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)
* Email us at [[email protected]](mailto:[email protected])
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfddhttps://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4phttps://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfddhttps://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4p
2024-07-01
Published