CVE-2026-33220 — Path Traversal in Weblate

CWE-22 — Path Traversal CWE-200 — Sensitive Information Exposure4 documents4 sources

Severity

6.8MEDIUMNVD

EPSS

0.0%

top 89.47%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Weblateorg Weblate Weblate

Timeline

PublishedApr 15

Latest updateApr 16

Description

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:NExploitability: 2.3 | Impact: 4.0

Affected Packages2 packages

▶PyPIweblate/weblate< 5.17

▶CVEListV5weblateorg/weblate< 5.17

🔴Vulnerability Details

VulDB

weblate up to 5.16 Translation Memory API path traversal (GHSA-mqph-7h49-hqfm)↗2026-04-16

▶

GHSA

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository↗2026-04-16

▶