Weblate 2026.5 Security Advisory: XSS and Privilege Escalation Fixes

Vulnerability Overview Weblate version 2026.5 resolves multiple security-related issues, including: 1. XSS Vulnerabilities: Hardened search preview and autocomplete features to prevent XSS attacks, and ceased exposing database error details upon upload failure. 2. Information Disclosure: Screenshot URL uploads, remote HTML extraction, JavaScript localization CDN, and URL health check redirects no longer reject internal or non-public targets. 3. Privilege Escalation: Gerrit review pushes no longer reject target branches containing push options; they track the target branch and suggest a short branch name before invoking when a full branch name is provided. 4. Data Leakage: Category announcements no longer appear across the entire project; translation announcement deletion now respects language scope permissions. 5. Other Security Issues: Merge request pushes no longer refresh stale fork remotes after changing repository hosting; per-project access tokens expire today but remain valid until the end of the day; malformed ALTCOA CAPTCHA submissions and repository URLs in webhook payloads no longer cause server errors; placeholders now merge overlapping non-nested spans from multiple files; backing up and moving Weblate logs no longer include OpenSSH post-quantum key exchange warnings from remote Borg connections; category repository paths are now handled more securely during cleanup and moving; locked component pages now display an unsubscribe action after unlocking notifications; project-level backups are now restored in the background to avoid web worker memory limits. Impact Scope These vulnerabilities may affect all users running Weblate version 2026.5, particularly those involved in scenarios handling sensitive information, permission management, and data security. Remediation 1. XSS Vulnerabilities: Prevented XSS attacks by hardening search preview and autocomplete features, and stopped exposing database error details on upload failure. 2. Information Disclosure: Screenshot URL uploads, remote HTML extraction, JavaScript localization CDN, and URL health check redirects no longer reject internal or non-public targets. 3. Privilege Escalation: Gerrit review pushes no longer reject target branches containing push options; they track the target branch and suggest a short branch name before invoking when a full branch name is provided. 4. Data Leakage: Category announcements no longer appear across the entire project; translation announcement deletion now respects language scope permissions. 5. Other Security Issues: Merge request pushes no longer refresh stale fork remotes after changing repository hosting; per-project access tokens expire today but remain valid until the end of the day; malformed ALTCOA CAPTCHA submissions and repository URLs in webhook payloads no longer cause server errors; placeholders now merge overlapping non-nested spans from multiple files; backing up and moving Weblate logs no longer include OpenSSH post-quantum key exchange warnings from remote Borg connections; category repository paths are now handled more securely during cleanup and moving; locked component pages now display an unsubscribe action after unlocking notifications; project-level backups are now restored in the background to avoid web worker memory limits. POC Code or Exploit Code No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Weblate 2026.5 Security Advisory: XSS and Privilege Escalation Fixes

More from this source