Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| weblate | pip | < 5.17 | 5.17 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patches reveals that the associated pull request addresses three separate vulnerabilities, although the GHSA advisory's title and impact description are contradictory and only mention parts of the issues.
The first vulnerability is a path traversal issue in the weblate.addons.tasks.cdn_parse_html function. This function, part of the CDN add-on, failed to sanitize file paths provided in the configuration, allowing an attacker to read arbitrary files from the server's filesystem. The patch introduces validation for both local and remote file paths.
The second vulnerability involves the translation memory API, where the weblate.api.views.MemoryViewSet was configured as a full ModelViewSet. This exposed create, update, and destroy endpoints that were not intended to be public and lacked sufficient access control. The fix was to change the base class to ReadOnlyModelViewSet, effectively removing the vulnerable write operations.
The third vulnerability is an access control flaw in the weblate.api.views.TaskViewSet.get_task method. The original implementation could not properly enforce permissions for pending tasks because it relied on the task's result to identify the associated component. The patch introduces a system to cache task metadata upon creation, allowing for reliable permission checks regardless of the task's state.
