CVE-2026-34242
Weblate is a web based localization tool.
Published Apr 15, 2026 · updated Jun 17, 2026 · weblate weblate
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 15, 2026 · NIST NVD
Detected
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
Jun 17, 2026 · NIST NVD
Updated
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
Affected
- cpe weblate/weblateversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-34242
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-34242
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
nvd.nist.gov