CVE-2025-68398
published 2025-12-18CVE-2025-68398: Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its…
PriorityP348critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| weblate | weblate | < 5.15.1 | 5.15.1 |
| weblate | weblate | >= 0 < 5.15.1 | 5.15.1 |
| weblateorg | weblate | < 5.15.1 | 5.15.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Weblate is vulnerable to RCE through Git config file overwrite
ghsa·2025-12-18
CVE-2025-68398 [CRITICAL] CWE-20 Weblate is vulnerable to RCE through Git config file overwrite
Weblate is vulnerable to RCE through Git config file overwrite
### Impact
It was possible to overwrite Git configuration remotely and override some of its behavior.
### Resources
Thanks to Jason Marcello for responsible disclosure.
OSV
Weblate is vulnerable to RCE through Git config file overwrite
osv·2025-12-18
CVE-2025-68398 [CRITICAL] Weblate is vulnerable to RCE through Git config file overwrite
Weblate is vulnerable to RCE through Git config file overwrite
### Impact
It was possible to overwrite Git configuration remotely and override some of its behavior.
### Resources
Thanks to Jason Marcello for responsible disclosure.
No detection rules found.
No public exploits indexed.
https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7https://github.com/WeblateOrg/weblate/pull/17330https://github.com/WeblateOrg/weblate/pull/17345https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
2025-12-18
Published