CVE-2026-21889
Low · 3.5Weblate leaks information via screenshots
CVSS
3.5
EPSS
0.4%
Published
Jan 14, 2026
CISA due date
—
The record
The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | weblate | 0 | 5.15.2 |
| openSUSE:Tumbleweed | weblate | 0 | 5.16-1.1 |
Related vulnerabilities
- GHSA-3g2f-4rjg-9385 Weblate leaks information via screenshots Same vulnerability
- CVE-2026-27457 Weblate is a web based localization tool. Also affects weblate
- GHSA-wppc-7cq7-cgfv Weblate: Missing access control for the AddonViewSet API exposes all addon configurations Also affects weblate
- CVE-2026-24126 Weblate is a web based localization tool. Also affects weblate
- GHSA-33fm-6gp7-4p47 Weblate has an argument injection in management console Also affects weblate
- GHSA-8vcg-cfxj-p5m3 Weblate is vulnerable to RCE through Git config file overwrite Also affects weblate
- CVE-2025-68398 Weblate is a web based localization tool. Also affects weblate
- GHSA-g925-f788-4jh7 Weblate has an arbitrary file read via symbolic links Also affects weblate