Vulnerability · Published Dec 18, 2025 · Assigned by GitHub_M
CVE-2025-68398Weblate has git config file overwrite vulnerability that leads to remote code execution
Critical 9.1
In plain English
A critical-severity improper input validation in weblate from WeblateOrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.8%top 43.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | weblate | 5.15.1 | GHSA-8vcg-cfxj-p5m3 |
| PyPI | weblate | 5.15.1 | PYSEC-2026-571 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WeblateOrg | weblate | < 5.15.1 |
Weakness: CWE-20, CWE-22, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3 x_refsource_CONFIRM
- https://github.com/WeblateOrg/weblate/pull/17330 x_refsource_MISC
- https://github.com/WeblateOrg/weblate/pull/17345 x_refsource_MISC
- https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4 x_refsource_MISC
- https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7 x_refsource_MISC
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1 x_refsource_MISC