Weblate is a web based localization tool.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 15, 2026 · NIST NVD

   Detected

   Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it i

2. Jun 17, 2026 · NIST NVD

   Updated

   Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it i

Affected

• cpe weblate/weblateversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-33435

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33435

  Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable t

  nvd.nist.gov

References

• Issue Tracking · github.com
• Third Party Advisory · github.com