CVE-2026-61792

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7

Description A project administrator can read files outside their repository using the App store metadata download feature. This occurs because the system resolves attacker-influenced paths without adequately confining them to the repository, leading to a path traversal. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the intended folder. Consequently, a user with project-administrator privileges can disclose the contents of arbitrary files on the Weblate host.

Recommendations Update to version 2026.7.