CVE-2026-33440
MEDIUMWeblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
Title source: cnaDescription
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
Scores
CVSS v3
5.0
EPSS
0.0001
EPSS Percentile
1.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Details
CWE
CWE-918
Status
published
Products (3)
pypi/weblate
0 - 5.17PyPI
weblate/weblate
< 5.17
WeblateOrg/weblate
< 5.17
Published
Apr 15, 2026
Tracked Since
Apr 16, 2026