CVE-2026-34242: Weblate Path Traversal Vulnerability

CVE-2026-34242 Overview

CVE-2026-34242 is a Path Traversal vulnerability affecting Weblate, a popular web-based localization tool. The vulnerability exists in versions prior to 5.17, where the ZIP download feature fails to properly validate downloaded files, potentially allowing attackers to follow symlinks outside the intended repository directory. This can lead to unauthorized access to sensitive files on the server.

Critical Impact

Authenticated users can exploit the symlink validation bypass in the ZIP download functionality to read arbitrary files outside the repository boundaries, potentially exposing sensitive configuration files, credentials, or other critical system data.

Affected Products

• Weblate versions prior to 5.17

Discovery Timeline

• April 15, 2026 - CVE-2026-34242 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-34242

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The flaw resides in Weblate's ZIP download feature, which processes repository files without adequately validating symlinks. When a malicious symlink is present within a repository, the ZIP download mechanism follows the symlink, potentially exposing files outside the repository's intended boundaries.

The vulnerability requires authentication (low privileges) and can be exploited remotely over the network without user interaction. The scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component's security scope. While confidentiality impact is high, there is no direct impact on integrity or availability of the system.

Root Cause

The root cause lies in insufficient validation of symlinks during the component file handling process. Prior to the fix, Weblate did not properly validate repository symlinks before processing them for ZIP downloads. This allowed specially crafted symlinks pointing to locations outside the repository directory to be followed and included in the downloaded archive.

Attack Vector

An authenticated attacker with repository access can exploit this vulnerability by:

1. Creating a malicious symlink within a repository that points to a sensitive file outside the repository boundaries (e.g., /etc/passwd, configuration files, or application secrets)
2. Triggering the ZIP download feature for the component containing the malicious symlink
3. The application follows the symlink without proper validation
4. Receiving a ZIP archive containing the contents of the targeted file outside the repository

The fix introduces proper symlink validation in the component file handling, including the addition of ValidationError handling in the gettext addon module.

# Security patch from weblate/addons/gettext.py
# Source: https://github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3

from pathlib import Path
from typing import TYPE_CHECKING, ClassVar

+from django.core.exceptions import ValidationError
from django.core.management.utils import find_command
from django.utils.translation import gettext_lazy

The changelog confirms the fix:

# Security patch from docs/changes.rst
# Source: https://github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3

 .. rubric:: Bug fixes

+* Component file handling now validates repository symlinks.
* Prevented removing the last team from a project token.
* Batch automatic translation now uses project-level machinery configuration instead of only site-wide settings.
* Fixed sorting by the **Unreviewed** column in listings.

Detection Methods for CVE-2026-34242

Indicators of Compromise

• Unusual symlinks within translation repositories pointing to paths outside the repository root
• ZIP download requests followed by access to sensitive files outside normal repository scope
• Audit logs showing file access patterns inconsistent with normal translation workflows
• Unexpected files appearing in downloaded ZIP archives

Detection Strategies

• Monitor file system access patterns for symlink traversal attempts outside repository directories
• Implement logging for all ZIP download operations and analyze for suspicious path patterns
• Review repository contents for unexpected symlinks pointing to sensitive system locations
• Audit user activity for unusual download patterns or access to multiple repositories

Monitoring Recommendations

• Enable verbose logging for the ZIP download feature and component file handling
• Set up alerts for file access attempts outside designated repository paths
• Monitor for path traversal indicators such as ../ sequences or absolute paths in repository files
• Implement file integrity monitoring on sensitive configuration directories

How to Mitigate CVE-2026-34242

Immediate Actions Required

• Upgrade Weblate to version 5.17 or later immediately
• Audit existing repositories for suspicious symlinks before upgrading
• Review recent ZIP download logs for potential exploitation attempts
• Restrict repository access to trusted users until patching is complete

Patch Information

Weblate has addressed this vulnerability in version 5.17. The fix implements proper symlink validation in the component file handling logic. The security patch is available in commit 5db3a2a2e047ecaab627a8731cd744a30b2f51d3.

For detailed information about the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-hv99-mxm5-q397.

Workarounds

• If immediate upgrade is not possible, disable or restrict access to the ZIP download feature
• Implement repository-level access controls to limit which users can create or modify repository contents
• Deploy a Web Application Firewall (WAF) rule to monitor and block suspicious download patterns
• Perform regular audits of repository contents to detect and remove malicious symlinks

# Example: Find symlinks in Weblate repository directories
find /path/to/weblate/repositories -type l -exec ls -la {} \;

# Check if any symlinks point outside the repository root
find /path/to/weblate/repositories -type l -exec readlink -f {} \; | grep -v "^/path/to/weblate/repositories"