CVE-2026-41654: Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
(updated )
An authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django’s full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False).
References
- github.com/WeblateOrg/weblate/commit/e1eff1f517c1ee315d69581910baaabb724e5ef0
- github.com/WeblateOrg/weblate/commit/e4b67a76d95d5165ecb9937f7485fd79223b7f14
- github.com/WeblateOrg/weblate/pull/19061
- github.com/WeblateOrg/weblate/pull/19062
- github.com/WeblateOrg/weblate/releases/tag/weblate-5.17.1
- github.com/WeblateOrg/weblate/security/advisories/GHSA-cwcx-382v-8m9g
- github.com/advisories/GHSA-cwcx-382v-8m9g
- nvd.nist.gov/vuln/detail/CVE-2026-41654
Code Behaviors & Features
Detect and mitigate CVE-2026-41654 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →