PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34242 WeblateOrg CVE debrief

CVE-2026-34242 is a high-severity vulnerability in Weblate, a web-based localization tool. In versions prior to 5.17, the ZIP download feature did not verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17. Defenders responsible for Weblate installations should assess exposure and prioritize upgrading to version 5.17 or later to prevent potential symlink attacks. The vulnerability allows attackers to potentially follow symlinks outside the repository, which can lead to security breaches. It is essential to verify Weblate installations and review configurations to ensure the ZIP download feature is properly secured.

Vendor
WeblateOrg
Product
weblate
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-15
Original CVE updated
2026-10-26
Advisory published
2026-04-15
Advisory updated
2026-10-26

Who should care

Defenders responsible for Weblate installations should assess exposure and prioritize upgrading to version 5.17 or later to prevent potential symlink attacks.

Why it matters

CVE-2026-34242 is a high-severity vulnerability in Weblate that allows attackers to potentially follow symlinks outside the repository. Defenders should prioritize verifying Weblate installations and upgrading to version 5.17 or later.

  • Defenders must verify Weblate installations to prevent potential symlink attacks.
  • Upgrading to version 5.17 or later is necessary to fix the vulnerability.
  • Reviewing Weblate configurations is necessary to ensure the ZIP download feature is properly secured.

Technical summary

The ZIP download feature in Weblate versions prior to 5.17 did not verify downloaded files, potentially allowing attackers to follow symlinks outside the repository. This vulnerability has been fixed in version 5.17. Defenders should prioritize verifying Weblate installations and upgrading to version 5.17 or later to prevent potential symlink attacks. The vulnerability allows attackers to potentially follow symlinks outside the repository, which can lead to security breaches. It is essential to review Weblate configurations to ensure the ZIP download feature is

Defensive priority

Defenders should prioritize verifying Weblate installations and upgrading to version 5.17 or later to prevent potential symlink attacks.

Recommended defensive actions

  • Verify Weblate installations to ensure they are running version 5.17 or later.
  • Upgrade Weblate to version 5.17 or later to fix the vulnerability.
  • Review Weblate configurations to ensure the ZIP download feature is properly secured.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability has been fixed in version 5.17 of Weblate. Defenders should verify Weblate installations to ensure they are running version 5.17 or later. The ZIP download feature in Weblate versions prior to 5.17 did not verify downloaded files, potentially allowing attackers to follow symlinks outside the repository. Evidence from the CVE record and NVD

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34242 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34242

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34242 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34242

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.