Path Traversal Vulnerability in Weblate Localization Platform

CVE-2026-61792

What is CVE-2026-61792?

Weblate is a widely used web-based continuous localization platform for managing software translations. However, in versions prior to 2026.7, it is possible for project administrators to exploit an inherent flaw in the app store metadata download feature, enabling them to read files located outside their designated repository. This vulnerability persists due to an insufficient resolution of path traversal issues and is a continuation of problems identified in earlier CVE patches. Users with project-administrator privileges can potentially expose sensitive information from files on the Weblate host, making it essential for users to upgrade to version 2026.7 or higher to safeguard against these risks.

References