-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Weblate | pip | < 5.15.1 | 5.15.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue in Weblate that allows an attacker to overwrite the .git/config file, leading to remote code execution. The root cause of the vulnerability lies in the validate_filename function, which failed to properly sanitize user-provided file paths, thus allowing traversal to sensitive directories like .git. The patch 0e8e80c4ac40cd95bbb9c1c9ccb60940fd6344f8 rectifies this by adding a check for prohibited paths within validate_filename. A specific example of a vulnerable code path is the Backup.validate method, which processes filenames from backup archives. Before the patch, this method used the flawed validate_filename function, making it possible for a malicious backup file to overwrite the git configuration. Additionally, commit 2d69b4215942ccbd0ea6a34be8f47031e57b414c was introduced as a defense-in-depth measure, hardening the system by changing the environment variable for git's SSH command to one with higher precedence, thereby making exploitation more difficult even if the configuration file is compromised.
validate_filenameweblate/utils/validators.py
Backup.validateweblate/trans/backups.py