CVE-2026-33435

{
  "id": "CVE-2026-33435",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T19:16:35.277",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects."
    },
    {
      "lang": "es",
      "value": "Weblate es una herramienta de localización basada en web. En versiones anteriores a la 5.17, la copia de seguridad del proyecto no filtraba los archivos de configuración de Git y Mercurial, lo que podría llevar a la ejecución remota de código bajo ciertas circunstancias. Este problema ha sido solucionado en la versión 5.17. Si los desarrolladores no pueden actualizar inmediatamente, pueden limitar el alcance de la vulnerabilidad restringiendo el acceso a la copia de seguridad del proyecto, ya que solo es accesible para los usuarios que pueden crear proyectos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WeblateOrg",
          "product": "weblate",
          "versions": [
            {
              "version": "< 5.17",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T18:40:18.548374Z",
          "id": "CVE-2026-33435",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.17",
              "matchCriteriaId": "64AD3B80-D39E-4EAF-9CF8-B4D3C8A6C58A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WeblateOrg/weblate/pull/18549",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-558g-h753-6m33",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}