CVE-2026-21889: Weblate leaks information via screenshots

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-14 · updated 2026-06-17
Weakness: CWE-284

Description

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

Affected products

WeblateOrg weblate: before 5.15.2 — fixed in 5.15.2

How to fix

Upgrade to a fixed version: WeblateOrg weblate 5.15.2. Check the vendor advisory for mitigations.

References

https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
https://github.com/WeblateOrg/weblate/pull/17516
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385

Get alerted when CVE-2026-21889 or the next vulnerability affects your stack