CVE-2026-33435: Weblate Remote Code Execution Vulnerability During Backup Restoration
Summary
CVE-2026-33435: Weblate: Remote code execution during backup restoration. Affects weblate versions < 5.17. Fixed in 5.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation tool that facilitates collaborative translation of software and other content. It supports various version control systems, including Git and Mercurial, allowing users to manage translations efficiently. However, a recent vulnerability has been identified that could expose users to remote code execution risks during the backup restoration process.
Vulnerability Detail
The vulnerability arises from the project's backup mechanism, which fails to adequately filter Git and Mercurial configuration files. This oversight can potentially allow an attacker to execute arbitrary code on the server when a compromised backup is restored. The implications of this vulnerability are severe, as it could lead to unauthorized access and manipulation of the server environment, affecting the integrity and confidentiality of the application.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.17
This is the first release that contains the fix.
pip install --upgrade "weblate==5.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the project backup feature to only those users who can create projects. This limits the scope of the vulnerability and reduces the risk of exploitation.
Conclusion
The identified vulnerability in Weblate poses a significant risk due to the potential for remote code execution during backup restoration. Users are strongly advised to update to the latest version to protect their systems. Implementing access restrictions can serve as a temporary measure while preparing for the update.
See every vulnerability recorded for weblate →
FAQ
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to remote code execution, allowing attackers to gain unauthorized access to the server and potentially compromise sensitive data.
Yes, a patch is available in version 5.17 of the Weblate package. Users are encouraged to update to this version to mitigate the risk.
If an immediate update is not possible, implement the workaround by restricting access to the project backup feature to limit exposure to the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
