CVE-2026-61792: Weblate Path Traversal Vulnerability

CVE-2026-61792 Overview

CVE-2026-61792 is a path traversal vulnerability [CWE-22] in Weblate, a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside of the project's repository through the App store metadata download feature. The feature resolves attacker-influenced paths without adequately confining them to the repository directory. This flaw is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent path traversal. The issue is fixed in version 2026.7.

Critical Impact
A user with project-administrator privileges can disclose the contents of arbitrary files on the Weblate host that reside outside the project's repository, leading to sensitive information disclosure.

Affected Products

Weblate versions prior to 2026.7
Self-hosted Weblate deployments exposing project administration to untrusted users
Hosted Weblate instances that had not yet applied the fix

Discovery Timeline

2026-08-26 - CVE-2026-61792 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-61792

Vulnerability Analysis

The vulnerability resides in Weblate's App store metadata download feature, which constructs filesystem paths from values that a project administrator can influence. The feature resolves these paths and returns file contents, but the containment check does not confine the resolved path to the project's repository root. An authenticated administrator can therefore supply crafted path segments or symbolic-link-backed inputs that resolve outside of the intended repository directory.

Because path resolution occurs before boundary validation, files on the Weblate host filesystem become readable through the download endpoint. This can expose configuration files, secrets, credentials, and other repositories present on the host.

Root Cause

The root cause is incomplete path containment during file download. The original fix for CVE-2026-34242 attempted to restrict downloads to a single repository root but did not correctly handle absolute paths, symlinks, or overlapping component roots. Weblate 2026.7 reworks the containment logic to enforce membership against a set of allowed roots and to reject paths that escape those roots after resolution.

Attack Vector

Exploitation requires network access to the Weblate web interface and project-administrator privileges on at least one project. The attacker triggers the App store metadata download with a path that resolves outside of the repository, and the server returns the contents of the targeted file. No user interaction is required beyond the attacker's own authenticated request.

python

# Patch excerpt: weblate/utils/views.py
# fix(security): restrict ZIP symlinks to component roots
-def _is_download_path(filename: str, root: str, resolved_root: Path) -> bool:
+def _get_allowed_roots(
+    root: str, allowed_roots: list[str] | None
+) -> list[tuple[Path, Path]]:
+    roots = [root] if allowed_roots is None else allowed_roots
+    result = []
+    for allowed_root in roots:
+        absolute_root = Path(os.path.abspath(allowed_root))
+        try:
+            resolved_root = absolute_root.resolve(strict=False)
+        except OSError:
+            continue
+        result.append((absolute_root, resolved_root))
+    result.sort(key=lambda paths: len(paths[0].parts), reverse=True)
+    return result
+
+
+def _get_containing_root(
+    filename: str, allowed_roots: list[tuple[Path, Path]]
+) -> tuple[Path, Path] | None:
+    absolute_filename = Path(os.path.abspath(filename))
+    for absolute_root, resolved_root in allowed_roots:
+        if absolute_filename.is_relative_to(absolute_root):
+            return absolute_root, resolved_root
+    return None

Source: Weblate commit 33a9acb

Detection Methods for CVE-2026-61792

Indicators of Compromise

Requests to the App store metadata download endpoint from project-administrator accounts referencing paths outside the project's repository tree.
Weblate access logs showing successful downloads whose resolved file paths lie outside of DATA_DIR or the component's repository root.
Unexpected access to symlinked files or repository metadata directories (for example .git) via download endpoints.

Detection Strategies

Audit Weblate application logs for download requests containing traversal sequences such as .., absolute path fragments, or unusual symlink targets.
Correlate project-administrator API activity with filesystem access patterns on the Weblate host to identify reads outside project repositories.
Compare installed Weblate version against 2026.7 and flag any instance running an earlier release.

Monitoring Recommendations

Enable verbose logging for file download and export endpoints and forward logs to a centralized analytics platform.
Alert on repeated download failures followed by successful downloads from the same administrator session, which can indicate path probing.
Monitor for read access to sensitive host paths such as /etc, home directories, and non-project repositories under the Weblate service account.

How to Mitigate CVE-2026-61792

Immediate Actions Required

Upgrade Weblate to version 2026.7 or later, which contains the corrected path containment logic.
Review and reduce the set of accounts holding project-administrator privileges, and rotate any credentials or secrets that may have been readable from the Weblate host.
Inspect Weblate logs for prior exploitation attempts against the App store metadata download feature.

Patch Information

The issue is fixed in Weblate 2026.7. The relevant changes are in the Weblate views commit and the ZIP download hardening commit. Full details are available in the GitHub Security Advisory GHSA-xwj4-fp82-r2rj.

Workarounds

Restrict project-administrator role assignments to trusted users until the upgrade is applied.
Run the Weblate service under a dedicated, unprivileged system account with filesystem access limited to DATA_DIR and required repositories.
Isolate the Weblate host from unrelated repositories, secrets, and configuration files to reduce the value of any arbitrary file read.

bash

# Upgrade Weblate via pip to the patched release
pip install --upgrade "Weblate>=2026.7"

# Or for Docker-based deployments, pin the fixed tag
# in docker-compose.override.yml:
#   image: weblate/weblate:2026.7
docker compose pull weblate
docker compose up -d weblate