CVE-2025-67492: Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook…

PriorityP430medium5.3CVSS 3.1

AVNACLPRNUINSUCLINAN

EPSS

0.26%

17.7th percentile

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
weblate	weblate	< 5.15	5.15
weblate	weblate	>= 0 < 5.15	5.15
weblateorg	weblate	< 5.15	5.15

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.