Weblate Vulnerability Exposes Sensitive Credentials in Web-based Localization Tool
CVE-2025-32021

7.5HIGH

Key Information:

Vendor

Weblateorg

Status
Weblate
Vendor
CVE Published:
15 April 2025

What is CVE-2025-32021?

Weblate, a popular web-based localization tool, has a vulnerability that allows sensitive credentials, such as GitHub personal access tokens and usernames, to be exposed during the creation of new components. This occurs when an existing component containing a source code repository URL is used. The inclusion of this URL in client-side parameters can lead to serious security risks, as credentials may be saved in browser history or logged in plaintext, especially in systems using the official Docker image with nginx logging. It is critical for users to upgrade to version 5.11 or later to mitigate these risks.

Affected Version(s)

weblate < 5.11

References

https://github.com/WeblateOrg/weblate/security/advisories...
x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/releases/tag/weblat...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.