Riskcovery

CVE-2025-68279

Weblate has an arbitrary file read via symbolic links

State
Published
Severity
7.7 High
Published
Dec 18, 2025
Updated
Dec 19, 2025
Reserved
Dec 16, 2025

Read the record on cve.org

Description

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-59 Improper Link Resolution Before File Access ('Link Following')
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
weblateWeblateOrg
  • < 5.15.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.