Weblate · Weblate · CVE-2026-86035
**Name of the Vulnerable Software and Affected Versions**
Weblate versions 4.11.1 through 2026.7.1
**Description**
An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen (-) may be interpreted as Mercurial options rather than literal paths. An authenticated user possessing project-scoped `component.edit` permission can exploit this via a Mercurial-backed RESX component using the Update RESX files add-on. This could allow the execution of arbitrary commands with the privileges of the Weblate service account during a subsequent repository update.
**Recommendations**
Update Weblate to version 2026.8.