CVE-2026-33440
Weblate is a web based localization tool.
Published Apr 15, 2026 · updated Jun 17, 2026 · weblate weblate
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 15, 2026 · NIST NVD
Detected
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
Jun 17, 2026 · NIST NVD
Updated
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
Affected
- cpe weblate/weblateversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33440
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33440
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
nvd.nist.gov