Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2026-34242

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-hv99-mxm5-q397

Weblate: Arbitrary File Read via Symlink ### Impact The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository. ### Patches * https://github.com/WeblateOrg/weblate/pull/18683 ### References Thanks to @DavidCarliez for reporting this vulnerability via GitHub.

gitlab/pypi/Weblate/CVE-2026-34242

Weblate: Arbitrary File Read via Symlink The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository.

pypa/weblate/PYSEC-2026-2313

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

pysec/PYSEC-2026-2313

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.