https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T19:48:27.829745+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-6131 EUVD-2026-6131 2026-10-08T19:48:27.832881+00:00 EUVD-2026-6131 https://cve.radiocsirt.org/vuln/fkie_cve-2024-39303 fkie_cve-2024-39303 2026-10-08T19:48:27.832913+00:00

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

 https://cve.radiocsirt.org/vuln/ghsa-jfgp-674x-6q4p GHSA-jfgp-674x-6q4p — Weblate vulnerable to improper sanitization of project backups 2026-10-08T19:48:27.832945+00:00

Affected: PyPI: Weblate

### Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file.

### Patches This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd.

### Workarounds Do not allow project creation to untrusted users.

### References Thanks to Bryan Cahill for bringing this issue to our attention.

### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14210-1 openSUSE-SU-2024:14210-1 — weblate-5.6.2-1.1 on GA media 2026-10-08T19:48:27.832976+00:00

weblate-5.6.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2041 PYSEC-2026-2041 — Weblate vulnerable to improper sanitization of project backups 2026-10-08T19:48:27.832994+00:00

Affected: PyPI: weblate

### Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file.

### Patches This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd.

### Workarounds Do not allow project creation to untrusted users.

### References Thanks to Bryan Cahill for bringing this issue to our attention.

### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)