Skip to content

Weblate vulnerable to improper sanitization of project backups

Moderate severity GitHub Reviewed Published Jul 1, 2024 in WeblateOrg/weblate • Updated Jul 2, 2024

Package

pip Weblate (pip)

Affected versions

>= 4.14, < 5.6.2

Patched versions

5.6.2

Description

Impact

Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to
files on the server using a crafted ZIP file.

Patches

This issue has been addressed in Weblate 5.6.2 via WeblateOrg/weblate@b6a7eac.

Workarounds

Do not allow project creation to untrusted users.

References

Thanks to Bryan Cahill for bringing this issue to our attention.

For more information

If you have any questions or comments about this advisory:

References

@nijel nijel published to WeblateOrg/weblate Jul 1, 2024
Published by the National Vulnerability Database Jul 1, 2024
Published to the GitHub Advisory Database Jul 1, 2024
Reviewed Jul 1, 2024
Last updated Jul 2, 2024

Severity

Moderate
4.4
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
High
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2024-39303

GHSA ID

GHSA-jfgp-674x-6q4p

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.