Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-24126. PoCs published by alexb616.
AI-analyzed exploit summary The repository contains a functional Python exploit for CVE-2026-24126, which leverages an argument injection vulnerability in Weblate's SSH key management endpoint to achieve arbitrary file read. The exploit authenticates as an admin, injects the `-f` flag into the `host` parameter, and extracts file contents from error messages.
Description
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
Exploits (1)
The repository contains a functional Python exploit for CVE-2026-24126, which leverages an argument injection vulnerability in Weblate's SSH key management endpoint to achieve arbitrary file read. The exploit authenticates as an admin, injects the `-f` flag into the `host` parameter, and extracts file contents from error messages.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L