CVE-2026-34244

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.

• CWE-200
• CWE-918

• https://github.com/WeblateOrg/weblate/commit/e619e9090202e4886b844c110d39308e7e882c0ePatch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-xrwr-fcw6-fmq8Third Party Advisory

Published

Apr 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34238ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-34239Chamilo version 1.11.40 and earlier are vulnerable to authen…7.5
• CVE-2026-34240JOSE is a Javascript Object Signing and Encryption (JOSE) li…7.5
• CVE-2026-34241CtrlPanel is open-source billing software for hosting provid…8.7
• CVE-2026-34242Weblate is a web based localization tool. In versions prior …7.7
• CVE-2026-34243wenxian is a tool to generate BIBTEX files from given identi…9.8
• CVE-2026-34245WWBN AVideo is an open source video platform. In versions up…6.3
• CVE-2026-34246CtrlPanel is open-source billing software for hosting provid…4.8
• CVE-2026-34247WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-34248Zammad is a web based open source helpdesk/customer support …5.7
• CVE-2026-3425The RTMKit Addons for Elementor plugin for WordPress is vuln…8.8
• CVE-2026-34253A buffer underflow vulnerability has been identified in the …8.2