CVE-2026-61792 WeblateOrg CVE debrief

Who should care

Defenders responsible for Weblate deployments, especially those with project administrator privileges, should assess exposure and apply the fix. This vulnerability requires verification of inventory and deployment contexts to ensure version 2026.7 is applied.

Why it matters

CVE-2026-61792 is a path traversal vulnerability in Weblate that allows project administrators to read files outside their repository. Defenders should verify exposure, apply the fix in version 2026.7, and update inventory to prevent file disclosure.

• Verification of Weblate deployments for exposure to this vulnerability is necessary to prevent file disclosure.
• Project administrators should be aware of the potential for reading files outside their repository.
• Applying the fix in version 2026.7 is crucial to prevent exploitation.
• Inventory checks and updates are required to ensure version 2026.7 is applied across all Weblate deployments.

Technical summary

The Weblate platform, used for continuous localization, has a path traversal vulnerability in versions prior to 2026.7. This issue allows project administrators to read files outside their repository through the App store metadata download feature. The vulnerability is a result of incomplete path confinement, enabling an attacker-influenced path resolution. This issue is an incomplete fix for CVE-2026-34242.

Defensive priority

Defenders should prioritize verifying exposure of Weblate installations to this vulnerability, especially for project administrators, and apply the fix in version 2026.7.

Recommended defensive actions

• Verify Weblate installations for exposure to this vulnerability, especially for project administrators.
• Apply the fix in version 2026.7 to prevent file disclosure.
• Review and update inventory of Weblate deployments to ensure version 2026.7 is applied.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on exploitation or affected deployments is limited. Defenders should verify Weblate installations for exposure, review inventory, and apply the fix. The vulnerability allows project administrators to read files outside their repository, disclosing file contents on the Weblate host. Evidence is limited, and defenders must take steps to verify and mitigate the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.