CVE-2026-61792: Weblateorg Weblate

High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.

Affected products

• Weblateorg Weblate: before 2026.7 (fixed in 2026.7)

Published 2026-08-26. Last modified 2026-09-09.