CVE-2026-21889: Weblate Information Leak via Unrestricted Screenshot Access
Summary
CVE-2026-21889: Weblate leaks information via screenshots. Affects weblate versions < 5.15.2. Fixed in 5.15.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Weblate is a web-based translation management system that facilitates collaborative translation efforts for software projects. It allows users to manage translations, track changes, and collaborate in real-time. However, a recent vulnerability has been identified that exposes sensitive information through improperly secured screenshot files, potentially allowing unauthorized access to these images.
Vulnerability Detail
The vulnerability arises from the fact that screenshot images in Weblate are served directly by the HTTP server without adequate access controls. This oversight enables unauthenticated users to access these screenshots simply by guessing their filenames. The implications of this vulnerability are significant, as it could lead to unauthorized exposure of sensitive information contained within the screenshots, thereby compromising user privacy and security.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15.2
This is the first release that contains the fix.
pip install --upgrade "weblate==5.15.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the directory where screenshots are stored or implement filename obfuscation to prevent unauthorized access until the package can be updated.
Conclusion
In summary, CVE-2026-21889 presents a significant security risk for Weblate users due to the improper handling of screenshot files. It is crucial to update to the latest version to mitigate this vulnerability and protect sensitive information.
See every vulnerability recorded for weblate →
FAQ
CVE-2026-21889 is a vulnerability in Weblate that allows unauthorized access to screenshot images due to improper access controls.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized exposure of sensitive information contained in screenshots, which could lead to privacy breaches.
You can update Weblate by running the command 'pip install --upgrade weblate' in your terminal.
Yes, you can restrict access to the screenshot directory or implement filename obfuscation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
