CVE-2026-39845

Published: Apr 15, 2026Modified: Jun 17, 2026

4.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Exploitability: 2.3 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.

Affected (1)

Products: Weblate: Weblate

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Weblate Weblate	Before 5.17

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://github.com/WeblateOrg/weblate/pull/18815

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-f8hv-g549-hwg2

Source: security-advisories@github.com

Third Party Advisory

Timeline

No history available yet.