VYPR
← All advisories
Low severityNVD Advisory· Published Jul 1, 2024· Updated Aug 2, 2024

Weblate vulnerabler to improper sanitization of project backups

CVE-2024-39303

Description

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
WeblatePyPI
>= 4.14, < 5.6.25.6.2

Affected products

1

Patches

1
b6a7eace155f

fix(backups): skip pontentially bogus files in backups

https://github.com/WeblateOrg/weblateMichal ČihařJun 27, 2024via ghsa
commit
1 file changed · +5 −3
  • weblate/trans/backups.py+5 −3 modified
    @@ -601,9 +601,11 @@ def restore(self, project_name: str, project_slug: str, user, billing=None):
             # Extract VCS
             for name in zipfile.namelist():
                 if name.startswith(self.VCS_PREFIX):
-                    targetpath = os.path.join(
-                        project.full_path, name[self.VCS_PREFIX_LEN :]
-                    )
+                    path = name[self.VCS_PREFIX_LEN :]
+                    # Skip potentially dangerous paths
+                    if path != os.path.normpath(path):
+                        continue
+                    targetpath = os.path.join(project.full_path, path)
                     upperdirs = os.path.dirname(targetpath)
                     if upperdirs and not os.path.exists(upperdirs):
                         os.makedirs(upperdirs)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.