CVE-2025-68398
Critical · 9.1CVSS
9.1
EPSS
0.8%
Published
Dec 18, 2025
CISA due date
—
The record
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | weblate | 0 | 5.15.1 |
| openSUSE:Tumbleweed | weblate | 0 | 5.14.3-2.1 |
Related vulnerabilities
- GHSA-8vcg-cfxj-p5m3 Weblate is vulnerable to RCE through Git config file overwrite Same vulnerability
- CVE-2026-27457 Weblate is a web based localization tool. Also affects weblate
- GHSA-wppc-7cq7-cgfv Weblate: Missing access control for the AddonViewSet API exposes all addon configurations Also affects weblate
- CVE-2026-24126 Weblate is a web based localization tool. Also affects weblate
- GHSA-33fm-6gp7-4p47 Weblate has an argument injection in management console Also affects weblate
- GHSA-3g2f-4rjg-9385 Weblate leaks information via screenshots Also affects weblate
- CVE-2026-21889 Weblate leaks information via screenshots Also affects weblate
- GHSA-g925-f788-4jh7 Weblate has an arbitrary file read via symbolic links Also affects weblate