VulertSecurity VulertSecurity

Vulnerability Database · PyPI · weblate · Version

weblate 5.12.1

5.12.1 is affected by 58 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 2026.10.1.

Critical 3 High 11 Medium 33 Low 10 Unrated 1

All weblate versions & vulnerabilities → Source repository Search the database for this package →
Released 16 Jun 2025 Licence GPL-3.0-or-later Also known from other sources 57 Newer releases 173 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

weblate 5.12.1 vulnerabilities

58 vulnerabilities cover weblate 5.12.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2025-68398: Weblate Remote Code Execution via Git Config File Overwrite 9.1 critical 5.15.1 29 Jun 2026
CVE-2026-24126: Weblate SSH Host Key Argument Injection Vulnerability 9.1 critical 5.16 19 Feb 2026
Critical Remote Code Execution Vulnerability in Weblate: Git Config File Overwrite 9.1 critical 5.15.1 18 Dec 2025
CVE-2026-34393: Weblate Privilege Escalation Vulnerability in User API Endpoint 8.8 high 5.17 16 Apr 2026
CVE-2026-34393: Weblate User Patching API Endpoint Scope Limitation Vulnerability 8.8 high 5.17 15 Apr 2026
CVE-2026-55228: Weblate IDOR Vulnerability Allows Unauthorized Access to Private Projects 8.1 high 2026.7 10 Sep 2026
CVE-2026-55228: Weblate IDOR Vulnerability Allows Unauthorized Access to Private Projects 8.1 high 2026.7 28 Aug 2026
CVE-2026-41654: Weblate Package Allows Import of Malicious Project Backup ZIP Leading to Unauthorized Repo URL Access 8.1 high 5.17.1 07 May 2026
CVE-2026-33435: Weblate Remote Code Execution Vulnerability During Backup Restoration 8.0 high 5.17 16 Apr 2026
CVE-2026-33435: Weblate Remote Code Execution Vulnerability Due to Inadequate Backup Filtering 8.0 high 5.17 15 Apr 2026
CVE-2025-68279: Weblate Arbitrary File Read via Symbolic Links 7.7 high 5.15.1 07 Jul 2026
CVE-2026-34242: Weblate Arbitrary File Read via Symlink Vulnerability 7.7 high 5.17 16 Apr 2026
CVE-2026-34242: Weblate ZIP Download Feature Vulnerability 7.7 high 5.17 15 Apr 2026
Arbitrary File Read Vulnerability in Weblate: Exploitable via Symbolic Links 7.7 high 5.15.1 18 Dec 2025
CVE-2026-33220: Weblate Arbitrary Local File Read via JavaScript Localization CDN Add-on 6.8 medium 5.17 16 Apr 2026
CVE-2026-33220: Weblate Translation Memory API Access Control Vulnerability 6.8 medium 5.17 15 Apr 2026
CVE-2026-24126: Weblate SSH Management Console Argument Injection Vulnerability 6.6 medium 5.16.0 17 Feb 2026
CVE-2025-61587: Weblate Open Redirect Vulnerability in Versions 5.13.2 and Below 6.1 medium 5.13.3 01 Oct 2025
CVE-2026-41519: Weblate Password Change Vulnerability Leading to Token Persistence 5.4 medium 5.17.1 07 May 2026
CVE-2026-41654: Weblate Authenticated SSRF Vulnerability via Project Backup Import 5.3 medium 5.17.1 30 Apr 2026
CVE-2025-67492: Weblate Vulnerability Allows Unauthorized Repository Updates via Webhook Payload 5.3 medium 5.15 16 Dec 2025
CVE-2025-67492: Weblate Over-Permissive Webhook Endpoint Enables Mass Repository Updates 5.3 medium 5.15 15 Dec 2025
CVE-2025-66407: Weblate Server-Side Request Forgery Vulnerability 5.0 medium 5.15 26 May 2026
CVE-2026-40256: Weblate Prefix-Based Repository Boundary Check Bypass Vulnerability 5.0 medium 5.17 16 Apr 2026
CVE-2026-34244: Weblate SSRF Vulnerability via Project-Level Machinery Configuration 5.0 medium 5.17 16 Apr 2026
CVE-2026-33440: Weblate Authenticated SSRF via Redirect Bypass in Screenshot URL Uploads 5.0 medium 5.17 16 Apr 2026
CVE-2026-40256: Weblate Path Validation Bypass Vulnerability 5.0 medium 5.17 15 Apr 2026
CVE-2026-33440: Weblate Improper Asset Domain Restriction Leading to Potential Redirects 5.0 medium 5.17 15 Apr 2026
CVE-2026-34244: Weblate SSRF Vulnerability in Versions Prior to 5.17 5.0 medium 5.17 15 Apr 2026
CVE-2025-66407: Weblate SSRF Vulnerability in Create Component Functionality 5.0 medium 5.15 16 Dec 2025
CVE-2026-45106: Weblate Stored HTML Injection in Editor Search Preview 4.6 medium 2026.5 13 Jul 2026
CVE-2026-45106: Weblate Stored HTML Injection in Editor Search Preview 4.6 medium 2026.5 15 May 2026
CVE-2026-55227: Weblate Object Existence Disclosure Vulnerability 4.3 medium 2026.7 10 Sep 2026
CVE-2026-55227: Weblate Package Exposes Object Existence Information via 403 Status Codes 4.3 medium 2026.7 28 Aug 2026
CVE-2026-44263: Weblate Vulnerability Allows Unauthorized Translation Enumeration 4.3 medium 5.17.1 07 May 2026
CVE-2026-44264: Weblate Markdown Renderer Improper Sanitization Vulnerability 4.3 medium 5.17.1 07 May 2026
CVE-2026-44264: Weblate XSS Vulnerability via Crafted Markdown 4.3 medium 5.17.1 07 May 2026
CVE-2026-44263: Weblate Vulnerable to Private Translation Enumeration via Screenshot API 4.3 medium 5.17.1 07 May 2026
CVE-2026-33214: Weblate Improper Access Control in Translation Memory API 4.3 medium 5.17 16 Apr 2026
CVE-2026-33214: Weblate Translation Memory API Access Control Vulnerability 4.3 medium 5.17 15 Apr 2026
CVE-2026-27457: Weblate Package Exposes All Addons via Inadequate User Permission Checks 4.3 medium 5.16.1 26 Feb 2026
CVE-2026-27457: Weblate Exposes Addon Configurations Due to Missing Access Control 4.3 medium 5.16.1 26 Feb 2026
CVE-2025-67715: Weblate API Information Disclosure Vulnerability 4.3 medium 5.15 16 Dec 2025
CVE-2025-67715: Weblate Systematic User and Project Enumeration via Broken Authorization in REST API 4.3 medium 5.15 15 Dec 2025
CVE-2026-41519: Weblate API Token Not Invalidated on Password Change 4.2 medium 5.17.1 30 Apr 2026
CVE-2026-39845: Weblate SSRF Vulnerability via Unprotected fetch_url() in Webhook Add-on 4.1 medium 5.17 16 Apr 2026
CVE-2026-39845: Weblate Webhook Add-on SSRF Vulnerability 4.1 medium 5.17 15 Apr 2026
CVE-2025-64326: Weblate IP Address Leakage in Audit Logs 3.5 low 5.14.1 06 Nov 2025
CVE-2026-33212: Weblate Improper Access Control for Pending Tasks in API 3.1 low 5.17 16 Apr 2026
CVE-2026-33212: Weblate Task API Access Control Vulnerability 3.1 low 5.17 15 Apr 2026
CVE-2025-64326: Weblate IP Address Leakage in Audit Logs 2.6 low 5.14.1 05 Nov 2025
CVE-2026-21889: Weblate Information Leak via Unprotected Screenshots 2.3 low 5.15.2 07 Jul 2026
CVE-2026-21889: Weblate Information Leak via Unrestricted Screenshot Access 2.3 low 5.15.2 14 Jan 2026
CVE-2025-58352: Weblate Long Session Expiry in Second Factor Verification 2.1 low 5.13.1 07 Jul 2026
CVE-2025-58352: Weblate Long Session Expiry Vulnerability 2.1 low 5.13.1 04 Sep 2025
CVE-2025-64725: Weblate Invitation Acceptance Vulnerability 1.0 low 5.15 07 Jul 2026
CVE-2025-64725: Weblate Improper Invitation Acceptance Vulnerability 1.0 low 5.15 15 Dec 2025
CVE-2022-24727: Weblate - Unsanitized Arguments in Git and Mercurial Integration N/A unrated 35d59f1f040541c358cece0a8d4a63183ca919b8 04 Mar 2022

Looking for another version, or everything Vulert holds for weblate?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About weblate 5.12.1

Is weblate 5.12.1 vulnerable?

Yes. 58 vulnerabilities in the Vulert database cover weblate 5.12.1: 3 critical, 11 high, 33 medium and 10 low, plus 1 not yet rated. The upgrade Vulert recommends is 2026.10.1, and each entry above names the fixed version to move to.

Which version of weblate should I use instead of 5.12.1?

2026.10.1 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 5.12.1 the latest release of weblate?

No. 5.12.1 was published 16 Jun 2025, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor weblate for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the weblate version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.