CVE-2026-33440: Weblate

Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days.

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

Affected products

• Weblate Weblate: before 5.17 (fixed in 5.17)

Published 2026-04-15. Last modified 2026-06-17.