5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67492

CVE-2025-67492: Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

Impact

It was possible to trigger repository updates for many repositories via a crafted webhook payload.

Patches

https://github.com/WeblateOrg/weblate/pull/17221

Workarounds

Disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.

References

Thanks to Hector Ruiz Ruiz & NaxusAI for responsibly disclosing this vulnerability to us.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67492

CVE-2025-67492:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Weblate	pip	< 5.15	5.15

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to trigger updates for multiple repositories using a crafted webhook payload. The analysis of the provided patch (commit 9cc21902cfd4ab75bb7e5efaae703cd648178fb3) reveals that the root cause lies in the post method of the HookView class in weblate/trans/views/hooks.py. Previously, this method used the full_name from the webhook payload to construct a database query using iendswith without proper validation. This allowed a malicious actor to use a short or empty string for full_name to match and trigger updates for a large number of repositories. The patch mitigates this by introducing a new validation function, validate_full_name, and changing the query logic to only use the broad iendswith match as a fallback when the initial, more specific query finds no results and the full_name is valid. Therefore, the HookView.post function is the primary vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.