CVE-2025-66407: Weblate Server-Side Request Forgery Vulnerability
Summary
CVE-2025-66407: Weblate has a Server-Side Request Forgery issue. Affects weblate versions < 5.15. Fixed in 5.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Weblate is an open-source web-based translation tool that facilitates collaborative translation of software and content. It supports various version control systems and allows users to manage translation components efficiently. However, a recent vulnerability has been identified that compromises its security, particularly affecting the way it handles repository URLs.
Vulnerability Detail
The vulnerability arises from the Create Component functionality in Weblate, which allows authorized users to specify a version control system and a source code repository URL. The repository URL is not properly validated or sanitized, enabling attackers to input arbitrary protocols, hostnames, and IP addresses. This leads to a Server-Side Request Forgery (SSRF) issue, allowing attackers to probe internal services and access sensitive information. The vulnerability is particularly severe in cloud environments, where it could expose internal-only endpoints, potentially leading to credential disclosure and full environment compromise.
How To Fix
Latest published version: 2026.10.1 as of 22 Oct 2026
pip install --upgrade "weblate==2026.10.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15
This is the first release that contains the fix.
pip install --upgrade "weblate==5.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove Mercurial from the VCS_BACKENDS configuration in Weblate. This can be done by editing the configuration file and excluding Mercurial, as the Git backend is not affected by this vulnerability. For example, update your configuration as follows:
VCS_BACKENDS = ['git']
Conclusion
The SSRF vulnerability in Weblate poses significant risks to users, particularly in cloud environments. It is crucial to update to the latest version to mitigate these risks. Additionally, implementing the suggested workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for weblate →
FAQ
The vulnerability is a Server-Side Request Forgery (SSRF) issue that allows attackers to access internal services and potentially sensitive information.
If you are using a version of Weblate prior to 5.15, your installation is likely affected by this vulnerability. You can check your version by running weblate --version.
The consequences include unauthorized access to internal services, exposure of sensitive data, and potential full environment compromise, especially in cloud setups.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 5.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weblate.
