CVE-2024-39303
Weblate vulnerabler to improper sanitization of project backups
- State
- Published
- Severity
- 4.4 Medium
- Published
- Jul 1, 2024
- Updated
- Aug 2, 2024
- Reserved
- Jun 21, 2024
Description
Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.4 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-73 External Control of File Name or Path
Affected Products
| Product | Versions |
|---|---|
weblateWeblateOrg |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.