CVE-2026-33220
published 2026-04-15CVE-2026-33220: Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform…
PriorityP431medium6.8CVSS 3.1
AVNACLPRLUIRSCCHINAN
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| weblate | weblate | < 5.17 | 5.17 |
| weblate | weblate | >= 0 < 5.17 | 5.17 |
| weblateorg | weblate | < 5.17 | 5.17 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
weblate up to 5.16 Translation Memory API path traversal (GHSA-mqph-7h49-hqfm)
vuldb·2026-04-16·CVSS 6.8
CVE-2026-33220 [MEDIUM] weblate up to 5.16 Translation Memory API path traversal (GHSA-mqph-7h49-hqfm)
A vulnerability was found in weblate up to 5.16. It has been declared as critical. The impacted element is an unknown function of the component Translation Memory API. The manipulation results in path traversal.
This vulnerability is cataloged as CVE-2026-33220. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
ghsa·2026-04-16
CVE-2026-33220 [MEDIUM] CWE-200 Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
### Impact
The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.
### Patches
* https://github.com/WeblateOrg/weblate/pull/18516
### Workarounds
The CDN add-on is not enabled by default.
### References
Thanks to @spbavarva for reporting this responsibly via GitHub.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-15
Published