CVE-2026-34242
published 2026-04-15CVE-2026-34242: Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks…
PriorityP346high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.53%
42.4th percentile
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| weblate | weblate | < 5.17 | 5.17 |
| weblate | weblate | >= 0 < 5.17 | 5.17 |
| weblateorg | weblate | < 2026.7 | 2026.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Weblate: Arbitrary File Read via Symlink
ghsa·2026-04-16
CVE-2026-34242 [HIGH] CWE-200 Weblate: Arbitrary File Read via Symlink
Weblate: Arbitrary File Read via Symlink
### Impact
The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository.
### Patches
* https://github.com/WeblateOrg/weblate/pull/18683
### References
Thanks to @DavidCarliez for reporting this vulnerability via GitHub.
VulDB
weblate up to 5.16 path traversal (GHSA-hv99-mxm5-q397)
vuldb·2026-04-16·CVSS 7.7
CVE-2026-34242 [HIGH] weblate up to 5.16 path traversal (GHSA-hv99-mxm5-q397)
A vulnerability identified as critical has been detected in weblate up to 5.16. Affected is an unknown function. Performing a manipulation results in path traversal.
This vulnerability is reported as CVE-2026-34242. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-15
Published