id: PYSEC-2026-2313
published: "2026-04-15T19:16:35.753Z"
modified: "2026-07-13T05:52:33.706983Z"
aliases:
- CVE-2026-34242
- GHSA-hv99-mxm5-q397
details: Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially  following symlinks outside the repository. This issue has been fixed in version 5.17.
affected:
- package:
    name: weblate
    ecosystem: PyPI
    purl: pkg:pypi/weblate
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "5.17"
  versions:
  - "1.9"
  - "2.0"
  - "2.1"
  - "2.10"
  - 2.10.1
  - "2.11"
  - "2.12"
  - "2.13"
  - 2.13.1
  - "2.14"
  - 2.14.1
  - "2.15"
  - "2.16"
  - "2.17"
  - 2.17.1
  - "2.18"
  - "2.19"
  - 2.19.1
  - "2.2"
  - "2.20"
  - "2.3"
  - "2.4"
  - "2.5"
  - "2.6"
  - "2.7"
  - "2.8"
  - "2.9"
  - "3.0"
  - 3.0.1
  - "3.1"
  - 3.1.1
  - "3.10"
  - 3.10.1
  - 3.10.2
  - 3.10.3
  - "3.11"
  - 3.11.1
  - 3.11.2
  - 3.11.3
  - "3.2"
  - 3.2.1
  - 3.2.2
  - "3.3"
  - "3.4"
  - "3.5"
  - 3.5.1
  - "3.6"
  - 3.6.1
  - "3.7"
  - 3.7.1
  - "3.8"
  - "3.9"
  - 3.9.1
  - "4.0"
  - 4.0.1
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - "4.1"
  - 4.1.1
  - "4.10"
  - 4.10.1
  - "4.11"
  - 4.11.1
  - 4.11.2
  - "4.12"
  - 4.12.1
  - 4.12.2
  - "4.13"
  - 4.13.1
  - "4.14"
  - 4.14.1
  - 4.14.2
  - "4.15"
  - 4.15.1
  - 4.15.2
  - "4.16"
  - 4.16.1
  - 4.16.2
  - 4.16.3
  - 4.16.4
  - "4.17"
  - "4.18"
  - 4.18.1
  - 4.18.2
  - "4.2"
  - 4.2.1
  - 4.2.2
  - "4.3"
  - 4.3.1
  - 4.3.2
  - "4.4"
  - 4.4.1
  - 4.4.2
  - "4.5"
  - 4.5.1
  - 4.5.2
  - 4.5.3
  - "4.6"
  - 4.6.1
  - 4.6.2
  - "4.7"
  - 4.7.1
  - 4.7.2
  - "4.8"
  - 4.8.1
  - "4.9"
  - 4.9.1
  - "5.0"
  - 5.0.1
  - 5.0.2
  - "5.1"
  - 5.1.1
  - "5.10"
  - 5.10.1
  - 5.10.2
  - 5.10.3
  - 5.10.4
  - "5.11"
  - 5.11.1
  - 5.11.3
  - 5.11.4
  - 5.12.1
  - 5.12.2
  - "5.13"
  - 5.13.1
  - 5.13.2
  - 5.13.3
  - "5.14"
  - 5.14.1
  - 5.14.2
  - 5.14.3
  - "5.15"
  - 5.15.1
  - 5.15.2
  - "5.16"
  - 5.16.1
  - 5.16.2
  - "5.2"
  - 5.2.1
  - "5.3"
  - 5.3.1
  - "5.4"
  - 5.4.1
  - 5.4.2
  - 5.4.3
  - "5.5"
  - 5.5.2
  - 5.5.3
  - 5.5.4
  - 5.5.5
  - "5.6"
  - 5.6.1
  - 5.6.2
  - "5.7"
  - 5.7.1
  - 5.7.2
  - 5.8.1
  - 5.8.2
  - 5.8.3
  - 5.8.4
  - 5.9.1
  - 5.9.2
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hv99-mxm5-q397
- type: FIX
  url: https://github.com/WeblateOrg/weblate/commit/5db3a2a2e047ecaab627a8731cd744a30b2f51d3
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N