CVE-2026-33440: Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-15 · updated 2026-10-26
Weakness: CWE-918

Description

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

Affected products

WeblateOrg weblate: before 5.17 — fixed in 5.17

How to fix

Upgrade to a fixed version: WeblateOrg weblate 5.17. Check the vendor advisory for mitigations.

References

https://github.com/WeblateOrg/weblate/commit/8be80625a864c8db5854503872a65e8a0b7399a6
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-5fhx-9jwj-867m

Get alerted when CVE-2026-33440 or the next vulnerability affects your stack