CyberRota Analysis
AI-GeneratedWeblate versions prior to 2026.7 are vulnerable to a path traversal flaw that allows project administrators to read files outside their designated repository through the App store metadata download feature. This vulnerability can lead to unauthorized disclosure of sensitive information stored on the Weblate host. Organizations using Weblate with project-administrator access should prioritize upgrading to version 2026.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.