CVE-2026-61792: Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
WeblateOrg · weblate
Affected: WeblateOrg · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 48% of scored CVEs
DescriptionCVE.org
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- WeblateOrg · weblate< 2026.7
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- WeblateOrg
- Published
- August 2026
- Bounty reports
- 1 disclosed on HackerOne
Disclosed bug bounty reports about CVE-2026-61792
The reports on HackerOne that name this CVE, with HackerOne's own outcome. Titles and metadata only.
- Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Weblate · 2026 · medium severityValid
CoverageNo articles yet
No CyberSIXT article names CVE-2026-61792 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.