CVE-2026-34242

Weblate: Arbitrary File Read via Symlink

7.7 HighFix available

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.46%Up 0.5 points since Apr 16, 2026

What each source reports

CVE List Score used 7.7

Weblate: Arbitrary File Read via Symlink

Record: CVE-2026-34242
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-22, CWE-59, CWE-200
Updated: 2026-11-02

EUVDEUVD-2026-23003 7.7

Record: EUVD-2026-23003
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hv99-mxm5-q397 7.7

Weblate: Arbitrary File Read via Symlink

Impact

The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository.

Patches

https://github.com/WeblateOrg/weblate/pull/18683

References

Thanks to @DavidCarliez for reporting this vulnerability via GitHub.

Record: GHSA-hv99-mxm5-q397
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-22, CWE-59, CWE-200
Updated: 2026-11-02

NVD 7.7

Record: CVE-2026-34242
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-22, CWE-59, CWE-200
Updated: 2026-11-02

OSV 7.7

Weblate: Arbitrary File Read via Symlink

Record: CVE-2026-34242
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-200, CWE-22, CWE-59
Updated: 2026-11-02

OSVGHSA-hv99-mxm5-q397 7.7

Weblate: Arbitrary File Read via Symlink

Impact

The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository.

Patches

https://github.com/WeblateOrg/weblate/pull/18683

References

Thanks to @DavidCarliez for reporting this vulnerability via GitHub.

Record: GHSA-hv99-mxm5-q397
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-200, CWE-22, CWE-59
Updated: 2026-11-02

OSVPYSEC-2026-2313 7.7

Record: PYSEC-2026-2313
CVSS 3.1: 7.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`weblate` PyPI	before 5.17	5.17
`weblate` PyPI	before 5.17, plus listed versions 1.92.02.12.102.10.1 Show 45 moreShow less 2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.93.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.63.6.13.73.7.1	5.17

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34242 is a high vulnerability (CVSS 7.7) in Weblate, published April 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in weblate 5.17.

References

This page doesn't list everything

Left out here: 113 versions. The JSON record has them.