PT-2026-33120

CVE-2026-34242

·

Published

2026-04-15

·

Updated

2026-08-29

Description by

CVSS 3.1
7.7
High
MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17
Description The ZIP download feature fails to verify downloaded files, which could allow the system to follow symbolic links (symlinks) located outside the repository.
Recommendations Update to version 5.17.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-59: Improper Link Resolution Before File Access (\'Link Following\')
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2026-34242
GHSA-HV99-MXM5-Q397
PYSEC-2026-2313
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com