Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wkpe-cvt3-w3d4
Vulnerability ID VCID-wkpe-cvt3-w3d4
Aliases CVE-2026-41654
GHSA-cwcx-382v-8m9g
Summary Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-41654
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-41654
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-41654
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2026-41654
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-cwcx-382v-8m9g
cvssv4 5.3 https://github.com/WeblateOrg/weblate
generic_textual MODERATE https://github.com/WeblateOrg/weblate
cvssv4 5.3 https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
generic_textual MODERATE https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
ssvc Track https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
cvssv4 5.3 https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
generic_textual MODERATE https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
ssvc Track https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
cvssv4 5.3 https://github.com/WeblateOrg/weblate/pull/19061
generic_textual MODERATE https://github.com/WeblateOrg/weblate/pull/19061
ssvc Track https://github.com/WeblateOrg/weblate/pull/19061
cvssv4 5.3 https://github.com/WeblateOrg/weblate/pull/19062
generic_textual MODERATE https://github.com/WeblateOrg/weblate/pull/19062
ssvc Track https://github.com/WeblateOrg/weblate/pull/19062
cvssv4 5.3 https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
generic_textual MODERATE https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
ssvc Track https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
cvssv3.1_qr MODERATE https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
cvssv4 5.3 https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
generic_textual MODERATE https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
ssvc Track https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-41654
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-41654
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-41654
https://github.com/WeblateOrg/weblate
https://nvd.nist.gov/vuln/detail/CVE-2026-41654
19061 https://github.com/WeblateOrg/weblate/pull/19061
19062 https://github.com/WeblateOrg/weblate/pull/19062
e1eff1f517c1ee315d69581910baaabb724e5ef0 https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
e4b67a76d95d5165ecb9937f7485fd79223b7f14 https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
GHSA-cwcx-382v-8m9g https://github.com/advisories/GHSA-cwcx-382v-8m9g
GHSA-cwcx-382v-8m9g https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
weblate-5.17.1 https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:23:34Z/ Found at https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:23:34Z/ Found at https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/pull/19061
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:23:34Z/ Found at https://github.com/WeblateOrg/weblate/pull/19061
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/pull/19062
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:23:34Z/ Found at https://github.com/WeblateOrg/weblate/pull/19062
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:23:34Z/ Found at https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-08T14:23:34Z/ Found at https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-41654
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07282
EPSS Score 0.00024
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:51:24.660755+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/41xxx/CVE-2026-41654.json 38.6.0