High severity7.7NVD Advisory· Published Apr 15, 2026· Updated Apr 21, 2026
CVE-2026-34242
CVE-2026-34242
Description
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
weblatePyPI | < 5.17 | 5.17 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3nvdPatchWEB
- github.com/WeblateOrg/weblate/security/advisories/GHSA-hv99-mxm5-q397nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-hv99-mxm5-q397ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-34242ghsaADVISORY
News mentions
0No linked articles in our index yet.