5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33440

CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33440

CVE-2026-33440:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17	5.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in Weblate's asset fetching mechanism, specifically when handling URL-based screenshot uploads and remote HTML file fetching for the CDN addon. The ALLOWED_ASSET_DOMAINS setting was intended to restrict asset downloads to a list of trusted domains. However, the validation was only performed on the initial URL provided by the user. The underlying HTTP client would automatically follow HTTP redirects without re-validating the new destination URL against the allowlist.

An authenticated attacker could exploit this by providing a URL from an allowed domain that redirects to a resource on a different, potentially internal or malicious, domain. This would cause the Weblate server to issue a request to the arbitrary domain, bypassing the intended security control.

The analysis of the patch 8be80625a864c8db5854503872a65e8a0b7399a6 reveals the fix and pinpoints the vulnerable code locations:

A new utility function, weblate.utils.requests.asset_request, was introduced. This function replaces the standard requests call and implements a manual redirect-following loop. Within this loop, it explicitly calls weblate.utils.validators.validate_asset_url for each URL in the redirect chain, ensuring that every hop is validated against ALLOWED_ASSET_DOMAINS.
The weblate.screenshots.forms.ScreenshotImageValidationMixin.download_image function, which handles screenshot uploads from a URL, was modified to use the new asset_request function instead of the generic http_request. The previous, insufficient validation on just the initial URL was removed, delegating the responsibility to the new secure request handler.
Similarly, the weblate.addons.tasks.cdn_parse_html function, which fetches remote HTML files, was also updated to use asset_request, patching the same SSRF-via-redirect flaw in that feature.

Therefore, during exploitation, a runtime profiler would have shown calls to ScreenshotImageValidationMixin.download_image or cdn_parse_html as the entry points that trigger the vulnerable asset download.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

CVE-2026-33440:

5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

5

5

Technical Details

5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

CVE-2026-33440:

5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5

5

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI