CVE-2024-39303 MEDIUM

CVE-2024-39303: Weblate vulnerabler to improper sanitization of project backups

Vendor Weblateorg
Product weblate
Weakness CWE-73
Published July 1, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

Key dates

02Disclosure timeline

July 1, 2024 CVE published
August 2, 2024 Record updated