CVE-2026-86035

Name of the Vulnerable Software and Affected Versions Weblate versions 4.11.1 through 2026.7.1

Description An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen (-) may be interpreted as Mercurial options rather than literal paths. An authenticated user possessing project-scoped component.edit permission can exploit this via a Mercurial-backed RESX component using the Update RESX files add-on. This could allow the execution of arbitrary commands with the privileges of the Weblate service account during a subsequent repository update.

Recommendations Update Weblate to version 2026.8.