7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34242

CVE-2026-34242: Weblate: Arbitrary File Read via Symlink

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34242

CVE-2026-34242:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.17	5.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'Arbitrary File Read via Symlink', stemmed from Weblate's failure to properly validate file paths in multiple features, most critically in the ZIP download functionality. The root cause was the use of os.path.join to construct paths based on component settings (e.g., template, new_base) without checking if these paths contained symbolic links that pointed outside the intended project directory. The primary vulnerable function identified is download_multi in weblate/trans/views/files.py. An attacker could create a component with a symlink as a template file, and this function would then read the linked file from anywhere on the filesystem and include it in a downloadable ZIP archive. The security patch addresses this by introducing and enforcing the use of a new get_validated_component_filename method in weblate/trans/models/component.py. This method centralizes path validation and ensures that any file path is resolved and checked to be within the project's repository before being accessed. The fix was applied not only to the ZIP download feature but also to several other areas like gettext addons, component discovery, and alert generation, which were susceptible to the same class of symlink-following vulnerability, preventing both arbitrary file reads and information disclosure about file existence.

Vulnerable functions

download_multi

weblate/trans/views/files.py

The `download_multi` function is responsible for creating a ZIP archive of translation files. Before the patch, it constructed file paths for auxiliary files (template, new_base, intermediate) using `os.path.join` without validating if the path components were symlinks. An attacker could configure a component with a symlink pointing to an arbitrary file on the server (e.g., `/etc/passwd`). When a user downloads the project files as a ZIP, this function would follow the symlink and include the content of the targeted file in the archive, leading to arbitrary file read.

UpdateLinguasAddon.sync_linguas

weblate/addons/gettext.py

The `sync_linguas` function reads the content of a `LINGUAS` file. The patch adds a call to `component.check_file_is_valid(path)` before opening the file. Prior to this change, if the `path` to the `LINGUAS` file was a symlink to a sensitive file outside the repository, this function would read and process its content, leading to arbitrary file read.

UpdateConfigureAddon.get_configure_paths

weblate/addons/gettext.py

The `get_configure_paths` function generates paths to configuration files. Before the patch, it used `os.path.join` to construct paths without validation. If a component's directory contained a symlink named 'configure', 'configure.in', or 'configure.ac' pointing to an external file, this function would yield the path to that external file, which could then be used by other parts of the addon.

Component.add_new_language

weblate/trans/models/component.py

The `add_new_language` function is used to add a new translation, which may involve creating new files or directories. The patch adds a `check_file_is_valid` call on the target file path. This suggests that without this check, it was possible to create a new translation where the target path was a symlink, potentially allowing writing to unintended locations. While the CVE is for file read, this is a related path traversal vulnerability fixed in the same patch.

InexistantFilesAlert.check_component

weblate/trans/models/alert.py

The `check_component` method within the `InexistantFilesAlert` class checks for the existence of component files like `template`, `intermediate`, and `new_base`. Before the patch, it used `os.path.exists(os.path.join(...))` without validating for symlinks. An attacker could set one of these file paths to a symlink pointing to a file outside the repository. The function would then check for the existence of the linked file, leaking information about the server's file system.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.