CVE
CVE-2026-33435
Weblate: Remote code execution during backup restoration
Impact
The project backup didn't filter Git and Mercurial configuration files and this could lead to remote code execution under certain circumstances.
Patches
- https://github.com/WeblateOrg/weblate/pull/18549
Workarounds
The project backup is only accessible to users who can create projects. Restricting access to this limits scope of the vulnerability.
References
This issue was reported by ggamno via HackerOne.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
8
-
3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
C
H
U
-
Related Resources
No items found.
References
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33, https://nvd.nist.gov/vuln/detail/CVE-2026-33435, https://github.com/WeblateOrg/weblate/pull/18549, https://github.com/WeblateOrg/weblate, https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-154.yaml
Basic Information
Ecosystem
