Vulnerability-Lookup

CVE-2025-66407 (GCVE-0-2025-66407)

Vulnerability from cvelistv5 – Published: 2025-12-15 23:36 – Updated: 2025-12-16 19:08

Title

Weblate has Server-Side Request Forgery vulnerability

Summary

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application’s error messages clearly differentiate between files that exist and files that do not, revealing information about the server’s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from `VCS_BACKENDS`; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-16 19:07 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/WeblateOrg/weblate/security/ad…	x_refsource_CONFIRM
https://github.com/WeblateOrg/weblate/pull/17102	x_refsource_MISC
https://github.com/WeblateOrg/weblate/pull/17103	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
WeblateOrg	weblate	Affected: < 5.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T19:07:51.759310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T19:08:03.470Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "weblate",
          "vendor": "WeblateOrg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application\u2019s error messages clearly differentiate between files that exist and files that do not, revealing information about the server\u2019s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from `VCS_BACKENDS`; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-15T23:36:25.682Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm"
        },
        {
          "name": "https://github.com/WeblateOrg/weblate/pull/17102",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WeblateOrg/weblate/pull/17102"
        },
        {
          "name": "https://github.com/WeblateOrg/weblate/pull/17103",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WeblateOrg/weblate/pull/17103"
        }
      ],
      "source": {
        "advisory": "GHSA-hfpv-mc5v-p9mm",
        "discovery": "UNKNOWN"
      },
      "title": "Weblate has Server-Side Request Forgery vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66407",
    "datePublished": "2025-12-15T23:36:25.682Z",
    "dateReserved": "2025-11-28T23:33:56.365Z",
    "dateUpdated": "2025-12-16T19:08:03.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-66407",
      "date": "2026-10-09",
      "epss": "0.0024",
      "percentile": "0.13873"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "weblate",
                "vendor": "WeblateOrg",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 5.15"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "14EFFA2F-0B87-4B40-936D-8A2BFBB069A2",
                    "versionEndExcluding": "5.15",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application\u2019s error messages clearly differentiate between files that exist and files that do not, revealing information about the server\u2019s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from `VCS_BACKENDS`; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message."
          },
          {
            "lang": "es",
            "value": "Weblate es una herramienta de localizaci\u00f3n basada en web. La funcionalidad \u0027Crear Componente\u0027 en Weblate permite a los usuarios autorizados a\u00f1adir nuevos componentes de traducci\u00f3n especificando tanto un sistema de control de versiones como una URL de repositorio de c\u00f3digo fuente de la que extraer. Sin embargo, antes de la versi\u00f3n 5.15, el campo de la URL del repositorio no est\u00e1 validado ni saneado, lo que permite a un atacante suministrar protocolos, nombres de host y direcciones IP arbitrarios, incluyendo localhost, direcciones de red internas y nombres de archivo locales. Cuando se selecciona el sistema de control de versiones Mercurial, Weblate expone la respuesta HTTP completa del lado del servidor para la URL proporcionada. Esto crea efectivamente una primitiva de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) que puede sondear servicios internos y devolver sus contenidos. Adem\u00e1s de acceder a puntos finales HTTP internos, el comportamiento tambi\u00e9n permite la enumeraci\u00f3n de archivos locales al intentar peticiones file: //. Aunque el contenido de los archivos no siempre se devuelva, los mensajes de error de la aplicaci\u00f3n diferencian claramente entre los archivos que existen y los que no, revelando informaci\u00f3n sobre la estructura del sistema de archivos del servidor. En entornos de nube, este comportamiento es particularmente peligroso, ya que los puntos finales solo internos, como los servicios de metadatos de la nube, pueden ser accesibles, lo que podr\u00eda llevar a la divulgaci\u00f3n de credenciales y al compromiso total del entorno. Esto ha sido abordado en la versi\u00f3n 5.15 de Weblate. Como soluci\u00f3n alternativa, elimine Mercurial de \u0027VCS_BACKENDS\u0027; el backend de Git no est\u00e1 afectado. El backend de Git ya estaba configurado para bloquear el protocolo de archivo y no expone el contenido de la respuesta HTTP en el mensaje de error."
          }
        ],
        "id": "CVE-2025-66407",
        "lastModified": "2026-10-07T19:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-66407",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T19:07:51.759310Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-16T00:16:02.357",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/WeblateOrg/weblate/pull/17102"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/WeblateOrg/weblate/pull/17103"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-66407",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-16T19:07:51.759310Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-16T19:07:58.663Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "weblate",
              "vendor": "WeblateOrg",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 5.15"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application\u2019s error messages clearly differentiate between files that exist and files that do not, revealing information about the server\u2019s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from `VCS_BACKENDS`; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-15T23:36:25.682Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm"
            },
            {
              "name": "https://github.com/WeblateOrg/weblate/pull/17102",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/WeblateOrg/weblate/pull/17102"
            },
            {
              "name": "https://github.com/WeblateOrg/weblate/pull/17103",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/WeblateOrg/weblate/pull/17103"
            }
          ],
          "source": {
            "advisory": "GHSA-hfpv-mc5v-p9mm",
            "discovery": "UNKNOWN"
          },
          "title": "Weblate has Server-Side Request Forgery vulnerability"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-66407",
        "datePublished": "2025-12-15T23:36:25.682Z",
        "dateReserved": "2025-11-28T23:33:56.365Z",
        "dateUpdated": "2025-12-16T19:08:03.470Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-263778

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:01

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:01:37.432697+00:00",
  "id": "EUVD-2026-263778"
}

FKIE_CVE-2025-66407

Vulnerability from fkie_nvd - Published: 2025-12-16 00:16 - Updated: 2026-10-07 19:10

Severity

5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/WeblateOrg/weblate/pull/17102	Issue Tracking, Patch
security-advisories@github.com	https://github.com/WeblateOrg/weblate/pull/17103	Issue Tracking, Patch
security-advisories@github.com	https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm	Vendor Advisory

Impacted products

	Vendor	Product	Version
	weblate	weblate	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "weblate",
          "vendor": "WeblateOrg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.15"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "14EFFA2F-0B87-4B40-936D-8A2BFBB069A2",
              "versionEndExcluding": "5.15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application\u2019s error messages clearly differentiate between files that exist and files that do not, revealing information about the server\u2019s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from `VCS_BACKENDS`; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message."
    },
    {
      "lang": "es",
      "value": "Weblate es una herramienta de localizaci\u00f3n basada en web. La funcionalidad \u0027Crear Componente\u0027 en Weblate permite a los usuarios autorizados a\u00f1adir nuevos componentes de traducci\u00f3n especificando tanto un sistema de control de versiones como una URL de repositorio de c\u00f3digo fuente de la que extraer. Sin embargo, antes de la versi\u00f3n 5.15, el campo de la URL del repositorio no est\u00e1 validado ni saneado, lo que permite a un atacante suministrar protocolos, nombres de host y direcciones IP arbitrarios, incluyendo localhost, direcciones de red internas y nombres de archivo locales. Cuando se selecciona el sistema de control de versiones Mercurial, Weblate expone la respuesta HTTP completa del lado del servidor para la URL proporcionada. Esto crea efectivamente una primitiva de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) que puede sondear servicios internos y devolver sus contenidos. Adem\u00e1s de acceder a puntos finales HTTP internos, el comportamiento tambi\u00e9n permite la enumeraci\u00f3n de archivos locales al intentar peticiones file: //. Aunque el contenido de los archivos no siempre se devuelva, los mensajes de error de la aplicaci\u00f3n diferencian claramente entre los archivos que existen y los que no, revelando informaci\u00f3n sobre la estructura del sistema de archivos del servidor. En entornos de nube, este comportamiento es particularmente peligroso, ya que los puntos finales solo internos, como los servicios de metadatos de la nube, pueden ser accesibles, lo que podr\u00eda llevar a la divulgaci\u00f3n de credenciales y al compromiso total del entorno. Esto ha sido abordado en la versi\u00f3n 5.15 de Weblate. Como soluci\u00f3n alternativa, elimine Mercurial de \u0027VCS_BACKENDS\u0027; el backend de Git no est\u00e1 afectado. El backend de Git ya estaba configurado para bloquear el protocolo de archivo y no expone el contenido de la respuesta HTTP en el mensaje de error."
    }
  ],
  "id": "CVE-2025-66407",
  "lastModified": "2026-10-07T19:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-66407",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-16T19:07:51.759310Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-16T00:16:02.357",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/WeblateOrg/weblate/pull/17102"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/WeblateOrg/weblate/pull/17103"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-HFPV-MC5V-P9MM

Vulnerability from github – Published: 2026-05-26 16:41 – Updated: 2026-05-26 16:41

Summary

Weblate has a Server-Side Request Forgery issue

Details

Impact

The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames.

When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application’s error messages clearly differentiate between files that exist and files that do not, revealing information about the server’s filesystem layout.

In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise.

Patches

This has been addressed in the Weblate 5.15 release.

https://github.com/WeblateOrg/weblate/pull/17103
https://github.com/WeblateOrg/weblate/pull/17102

Workarounds

Removing Mercurial from VCS_BACKENDS avoids this vulnerability, as the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message.

References

Thanks to Jason Marcello for responsible disclosure.

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Weblate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66407"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-26T16:41:13Z",
    "nvd_published_at": "2025-12-16T00:16:02Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames.\n\nWhen the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application\u2019s error messages clearly differentiate between files that exist and files that do not, revealing information about the server\u2019s filesystem layout.\n\n\n\nIn cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise.\n\n### Patches\n\nThis has been addressed in the Weblate 5.15 release.\n\n* https://github.com/WeblateOrg/weblate/pull/17103\n* https://github.com/WeblateOrg/weblate/pull/17102\n\n### Workarounds\n\nRemoving Mercurial from [VCS_BACKENDS](https://docs.weblate.org/en/latest/admin/config.html#vcs-backends) avoids this vulnerability, as the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message.\n\n### References\nThanks to Jason Marcello for responsible disclosure.",
  "id": "GHSA-hfpv-mc5v-p9mm",
  "modified": "2026-05-26T16:41:13Z",
  "published": "2026-05-26T16:41:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66407"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/pull/17102"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WeblateOrg/weblate/pull/17103"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WeblateOrg/weblate"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2025-231.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Weblate has a Server-Side Request Forgery issue"
}

PYSEC-2025-231

Vulnerability from pysec - Published: 2025-12-16 00:16 - Updated: 2026-05-20 09:19

Details

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application’s error messages clearly differentiate between files that exist and files that do not, revealing information about the server’s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from VCS_BACKENDS; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message.

Severity

5.0 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Impacted products

Name	purl
weblate	pkg:pypi/weblate

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "weblate",
        "purl": "pkg:pypi/weblate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9",
        "2.0",
        "2.1",
        "2.10",
        "2.10.1",
        "2.11",
        "2.12",
        "2.13",
        "2.13.1",
        "2.14",
        "2.14.1",
        "2.15",
        "2.16",
        "2.17",
        "2.17.1",
        "2.18",
        "2.19",
        "2.19.1",
        "2.2",
        "2.20",
        "2.3",
        "2.4",
        "2.5",
        "2.6",
        "2.7",
        "2.8",
        "2.9",
        "3.0",
        "3.0.1",
        "3.1",
        "3.1.1",
        "3.10",
        "3.10.1",
        "3.10.2",
        "3.10.3",
        "3.11",
        "3.11.1",
        "3.11.2",
        "3.11.3",
        "3.2",
        "3.2.1",
        "3.2.2",
        "3.3",
        "3.4",
        "3.5",
        "3.5.1",
        "3.6",
        "3.6.1",
        "3.7",
        "3.7.1",
        "3.8",
        "3.9",
        "3.9.1",
        "4.0",
        "4.0.1",
        "4.0.2",
        "4.0.3",
        "4.0.4",
        "4.1",
        "4.1.1",
        "4.10",
        "4.10.1",
        "4.11",
        "4.11.1",
        "4.11.2",
        "4.12",
        "4.12.1",
        "4.12.2",
        "4.13",
        "4.13.1",
        "4.14",
        "4.14.1",
        "4.14.2",
        "4.15",
        "4.15.1",
        "4.15.2",
        "4.16",
        "4.16.1",
        "4.16.2",
        "4.16.3",
        "4.16.4",
        "4.17",
        "4.18",
        "4.18.1",
        "4.18.2",
        "4.2",
        "4.2.1",
        "4.2.2",
        "4.3",
        "4.3.1",
        "4.3.2",
        "4.4",
        "4.4.1",
        "4.4.2",
        "4.5",
        "4.5.1",
        "4.5.2",
        "4.5.3",
        "4.6",
        "4.6.1",
        "4.6.2",
        "4.7",
        "4.7.1",
        "4.7.2",
        "4.8",
        "4.8.1",
        "4.9",
        "4.9.1",
        "5.0",
        "5.0.1",
        "5.0.2",
        "5.1",
        "5.1.1",
        "5.10",
        "5.10.1",
        "5.10.2",
        "5.10.3",
        "5.10.4",
        "5.11",
        "5.11.1",
        "5.11.3",
        "5.11.4",
        "5.12.1",
        "5.12.2",
        "5.13",
        "5.13.1",
        "5.13.2",
        "5.13.3",
        "5.14",
        "5.14.1",
        "5.14.2",
        "5.14.3",
        "5.2",
        "5.2.1",
        "5.3",
        "5.3.1",
        "5.4",
        "5.4.1",
        "5.4.2",
        "5.4.3",
        "5.5",
        "5.5.2",
        "5.5.3",
        "5.5.4",
        "5.5.5",
        "5.6",
        "5.6.1",
        "5.6.2",
        "5.7",
        "5.7.1",
        "5.7.2",
        "5.8.1",
        "5.8.2",
        "5.8.3",
        "5.8.4",
        "5.9.1",
        "5.9.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66407",
    "GHSA-hfpv-mc5v-p9mm"
  ],
  "details": "Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application\u2019s error messages clearly differentiate between files that exist and files that do not, revealing information about the server\u2019s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services may be accessible, potentially leading to credential disclosure and full environment compromise. This has been addressed in the Weblate 5.15 release. As a workaround, remove Mercurial from `VCS_BACKENDS`; the Git backend is not affected. The Git backend was already configured to block the file protocol and does not expose the HTTP response content in the error message.",
  "id": "PYSEC-2025-231",
  "modified": "2026-05-20T09:19:23.676060Z",
  "published": "2025-12-16T00:16:02.357Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm"
    },
    {
      "type": "FIX",
      "url": "https://github.com/WeblateOrg/weblate/pull/17102"
    },
    {
      "type": "FIX",
      "url": "https://github.com/WeblateOrg/weblate/pull/17103"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-66407 (GCVE-0-2025-66407)

EUVD-2026-263778

FKIE_CVE-2025-66407

GHSA-HFPV-MC5V-P9MM

Impact

Patches

Workarounds

References

PYSEC-2025-231

Tags

Sightings

Nomenclature

Related by attack behaviour