CVE-2026-34244

{
  "id": "CVE-2026-34244",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-15T19:16:35.903",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project \"Administration\" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting."
    },
    {
      "lang": "es",
      "value": "Weblate es una herramienta de localización basada en web. En versiones anteriores a la 5.17, un usuario con el permiso project.edit (otorgado por el rol ’Administración’ por proyecto) puede configurar URLs de servicios de traducción automática apuntando a direcciones de red internas arbitrarias. Durante la validación de la configuración, Weblate realiza una petición HTTP a la URL controlada por el atacante y refleja hasta 200 caracteres del cuerpo de la respuesta de vuelta al usuario en un mensaje de error. Esto constituye una Falsificación de Petición del Lado del Servidor (SSRF) con lectura parcial de la respuesta. Este problema ha sido solucionado en la versión 5.17. Si los desarrolladores no pueden actualizar inmediatamente, pueden limitar los servicios de maquinaria disponibles a través de la configuración WEBLATE_MACHINERY."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WeblateOrg",
          "product": "weblate",
          "versions": [
            {
              "version": "< 517",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-15T18:49:58.571248Z",
          "id": "CVE-2026-34244",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.17",
              "matchCriteriaId": "64AD3B80-D39E-4EAF-9CF8-B4D3C8A6C58A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WeblateOrg/weblate/commit/e619e9090202e4886b844c110d39308e7e882c0e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    }
  ]
}