Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rfk6-ty49-f3ft
Vulnerability ID VCID-rfk6-ty49-f3ft
Aliases CVE-2025-68398
GHSA-8vcg-cfxj-p5m3
Summary Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-20 Improper Input Validation
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00249 https://api.first.org/data/v1/epss?cve=CVE-2025-68398
epss 0.00249 https://api.first.org/data/v1/epss?cve=CVE-2025-68398
epss 0.00249 https://api.first.org/data/v1/epss?cve=CVE-2025-68398
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-8vcg-cfxj-p5m3
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate
generic_textual CRITICAL https://github.com/WeblateOrg/weblate
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
generic_textual CRITICAL https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
ssvc Track https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
generic_textual CRITICAL https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
ssvc Track https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate/pull/17330
generic_textual CRITICAL https://github.com/WeblateOrg/weblate/pull/17330
ssvc Track https://github.com/WeblateOrg/weblate/pull/17330
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate/pull/17345
generic_textual CRITICAL https://github.com/WeblateOrg/weblate/pull/17345
ssvc Track https://github.com/WeblateOrg/weblate/pull/17345
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
generic_textual CRITICAL https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
ssvc Track https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
cvssv3.1 9.1 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
cvssv3.1_qr CRITICAL https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
generic_textual CRITICAL https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
ssvc Track https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2025-68398
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2025-68398
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-68398
https://github.com/WeblateOrg/weblate
17330 https://github.com/WeblateOrg/weblate/pull/17330
17345 https://github.com/WeblateOrg/weblate/pull/17345
4837a4154390f7c1d03c0e398aa6439dcfa361b4 https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
CVE-2025-68398 https://nvd.nist.gov/vuln/detail/CVE-2025-68398
dd8c9d7b00eebe28770fa0e2cd96126791765ea7 https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
GHSA-8vcg-cfxj-p5m3 https://github.com/advisories/GHSA-8vcg-cfxj-p5m3
GHSA-8vcg-cfxj-p5m3 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
weblate-5.15.1 https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-19T14:58:31Z/ Found at https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-19T14:58:31Z/ Found at https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate/pull/17330
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-19T14:58:31Z/ Found at https://github.com/WeblateOrg/weblate/pull/17330
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate/pull/17345
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-19T14:58:31Z/ Found at https://github.com/WeblateOrg/weblate/pull/17345
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-19T14:58:31Z/ Found at https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-12-19T14:58:31Z/ Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-68398
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.48397
EPSS Score 0.00249
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:58:59.420405+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/68xxx/CVE-2025-68398.json 38.6.0