CVE-2026-41654

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.

• CWE-20
• CWE-918

• https://github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0Patch
• https://github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14Patch
• https://github.com/WeblateOrg/weblate/pull/19061Issue Tracking, Patch
• https://github.com/WeblateOrg/weblate/pull/19062Issue Tracking, Patch
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1Release Notes
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9gPatch, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41648Incus is a system container and virtual machine manager. Pri…5
• CVE-2026-41649Outline is a service that allows for collaborative documenta…7.7
• CVE-2026-4165A vulnerability has been found in Worksuite HR, CRM and Proj…2.4
• CVE-2026-41650fast-xml-parser allows users to process XML from JS object w…6.1
• CVE-2026-41651PackageKit is a a D-Bus abstraction layer that allows the us…8.8
• CVE-2026-41653BentoPDF is a client-side PDF toolkit that is self hostable.…7
• CVE-2026-41655Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-41656Admidio is an open-source user management solution. Prior to…4.5
• CVE-2026-41657Admidio is an open-source user management solution. Prior to…4.9
• CVE-2026-41658Admidio is an open-source user management solution. Prior to…6.5
• CVE-2026-41659Admidio is an open-source user management solution. Prior to…2.7
• CVE-2026-4166A vulnerability was found in Wavlink WL-NU516U1 240425. The …3.5