Dashboard / CVE-2026-33435

CVE-2026-33435

HIGH
MEDIUM Priority: 0.06 BB Relevance: 51/100
Published: 2026-04-15 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
S: Changed
C: High
I: High
A: High

Description

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

Weakness Classification (3)

Affected Software (1)

VendorProductVersion
weblate weblate < 5.17

References & Advisories (2)

Bug Bounty Relevance

51 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

8.0 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

0.71%
Raw Score 0.007080
Percentile 53.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00708
2026-10-28
0.00708

Intelligence Sources

nvd ref →

External Links