CVE-2026-33220 | THREATINT

Description

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

PUBLISHED Reserved 2026-03-17 | Published 2026-04-15 | Updated 2026-04-16 | Assigner GitHub_M

MEDIUM: 6.8CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

< 5.17

affected

References

github.com/...eblate/security/advisories/GHSA-mqph-7h49-hqfm

github.com/WeblateOrg/weblate/pull/18516

cve.org (CVE-2026-33220)

nvd.nist.gov (CVE-2026-33220)

Download JSON