CVE-2024-39303

mediumpriority · track · 22EPSS 0.003 · 25 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.32% (25th) EPSS
CVSS 5.4 · medium
Is it mine?
3 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.

01

cvss

Technical severity, 0–10. One row per scoring source.

5.4
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.5
v3.14.4mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:Nsecondary · ENISA EU
v3.14.4mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:Nsecondary · security-advisories@github.comexploitability 1.3 · impact 2.7
v3.14.4mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:Nsecondary · OSV
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-73USCWE-73US
04

affected products (3)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • GHSA-jfgp-674x-6q4pWeblate vulnerable to improper sanitization of project backups2024-07-01ghsa · osvUS

    ### Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. ### Patches This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd. ### Workarounds Do not allow project creation to untrusted users. ### References Thanks to Bryan Cahill for bringing this issue to our attention. ### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

  • PYSEC-2026-2041Weblate vulnerable to improper sanitization of project backups2026-07-07vendor · osvUS

    ### Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. ### Patches This issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd. ### Workarounds Do not allow project creation to untrusted users. ### References Thanks to Bryan Cahill for bringing this issue to our attention. ### For more information If you have any questions or comments about this advisory: * Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions) * Email us at [care@weblate.org](mailto:care@weblate.org)

06

also known as (6)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvnvdNVDCVE.orgMITRE
published 2024-07-01modified 2026-06-17
08

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan