CVE-2025-32021: Weblate Information Disclosure Flaw

CVE-2025-32021 Overview

CVE-2025-32021 is a sensitive data exposure vulnerability in Weblate, a web-based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If the source code repository URL contains credentials (such as GitHub Personal Access Tokens), these confidential credentials are exposed in plaintext through browser history, server logs, and potentially other logging mechanisms.

Critical Impact

GitHub credentials including Personal Access Tokens (PATs) and usernames can be exposed in plaintext through browser history, server logs, and nginx access logs when using the official Weblate Docker image, potentially leading to unauthorized repository access and supply chain attacks.

Affected Products

• Weblate versions prior to 5.11
• Weblate Official Docker Image (nginx logs credentials in plaintext)
• Any Weblate deployment using repository URLs with embedded credentials

Discovery Timeline

• April 15, 2025 - CVE-2025-32021 published to NVD
• April 30, 2025 - Last updated in NVD database

Technical Details for CVE-2025-32021

Vulnerability Analysis

This vulnerability falls under CWE-598 (Use of GET Request Method With Sensitive Query Strings), a category of information disclosure vulnerabilities where sensitive data is transmitted through URL parameters rather than more secure channels. The core issue stems from Weblate's component creation workflow passing source code repository URLs—which may contain embedded authentication credentials—as GET parameters in the browser's address bar.

When administrators create new Weblate components based on existing components that have source repository URLs configured, the application copies this URL into query parameters. This design flaw causes credentials embedded in repository URLs (a common pattern for Git authentication) to be exposed through multiple channels including browser history, HTTP referrer headers, and server access logs.

Root Cause

The root cause is improper handling of sensitive information during the component creation process. Weblate's architecture passes the full repository URL, including any embedded credentials, through URL query parameters rather than using a more secure method such as POST request bodies or server-side session storage. This violates security best practices for handling authentication credentials in web applications.

Attack Vector

The vulnerability is exploitable through network access without authentication requirements. An attacker could potentially obtain exposed credentials through several vectors:

1. Browser History Access: Any user with access to the administrator's browser history could view the exposed credentials in plaintext
2. Log File Analysis: Attackers with access to web server logs (such as nginx access logs in Docker deployments) can extract credentials from logged request URLs
3. Referrer Header Leakage: If the page links to external resources, the full URL including credentials may be sent in HTTP Referrer headers
4. Shoulder Surfing: Credentials displayed in the browser address bar can be observed by nearby individuals

The vulnerability is particularly concerning in environments using the official Weblate Docker image, where nginx is configured to log complete request URLs including the sensitive query parameters.

Detection Methods for CVE-2025-32021

Indicators of Compromise

• Presence of repository URLs containing credentials (e.g., github.com/username:token@) in nginx access logs
• Browser history entries containing Weblate component creation URLs with authentication tokens
• Unusual repository access patterns from GitHub or other version control providers
• Audit log entries showing component creation activities with credential-bearing URLs

Detection Strategies

• Review nginx access logs for Weblate component creation endpoints containing authentication patterns in query strings
• Implement log analysis rules to detect URLs containing credential patterns such as username:token@ or PAT_ prefixes
• Monitor for unauthorized access to repositories that use credentials potentially exposed through this vulnerability
• Search browser history databases for Weblate URLs containing authentication tokens

Monitoring Recommendations

• Enable enhanced logging for Weblate administrative actions, particularly component creation workflows
• Implement real-time alerting for log entries containing potential credential patterns in URL parameters
• Monitor GitHub or GitLab audit logs for unusual API token usage that may indicate compromised credentials
• Deploy SentinelOne Singularity to detect and alert on suspicious access patterns to credential stores

How to Mitigate CVE-2025-32021

Immediate Actions Required

• Upgrade Weblate to version 5.11 or later immediately
• Rotate all credentials that may have been exposed through repository URLs in affected Weblate deployments
• Review and purge nginx access logs that may contain plaintext credentials
• Clear browser history on systems used to administer Weblate instances

Patch Information

The vulnerability is addressed in Weblate version 5.11. Organizations should upgrade to this version or later to remediate the vulnerability. The fix modifies how repository URLs are handled during component creation to prevent credential exposure through URL parameters.

For detailed patch information and release notes, refer to the Weblate 5.11 Release Notes and the GitHub Security Advisory GHSA-m67m-3p5g-cw9j.

Workarounds

• Avoid using repository URLs with embedded credentials; instead use SSH keys or OAuth app integrations where possible
• Implement network segmentation to limit access to Weblate log files
• Configure nginx to redact or exclude query parameters from access logs for sensitive endpoints
• Use a reverse proxy configuration that strips credentials from logged URLs

# Example nginx configuration to exclude sensitive query parameters from logs
# Add to your Weblate nginx configuration

# Define a custom log format that excludes query strings
log_format weblate_safe '$remote_addr - $remote_user [$time_local] '
                        '"$request_method $uri" $status $body_bytes_sent '
                        '"$http_referer" "$http_user_agent"';

# Apply the safe log format to Weblate server block
server {
    # ... existing configuration ...
    
    access_log /var/log/nginx/weblate-access.log weblate_safe;
}