{"id":"CVE-2024-39303","aliases":["GHSA-jfgp-674x-6q4p","PYSEC-2026-2041"],"title":"Weblate vulnerable to improper sanitization of project backups","summary":"Weblate vulnerable to improper sanitization of project backups","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","vendor":"weblate","product":"weblate","ecosystem":"pip","affected":["weblate >= 4.14, < 5.6.2"],"patched":["weblate 5.6.2"],"published":"2024-07-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:16.927291098Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jfgp-674x-6q4p","references":[{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-jfgp-674x-6q4p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39303"},{"url":"https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd"},{"url":"https://github.com/WeblateOrg/weblate"}],"tags":["osv","pip"],"epss":0.00318,"epssPercentile":0.22099,"ingestedAt":"2026-07-08T18:25:50.655Z","slug":"CVE-2024-39303","body":"## Overview\n\n### Impact\nWeblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to\nfiles on the server using a crafted ZIP file.\n\n### Patches\nThis issue has been addressed in Weblate 5.6.2 via https://github.com/WeblateOrg/weblate/commit/b6a7eace155fa0feaf01b4ac36165a9c5e63bfdd.\n\n### Workarounds\nDo not allow project creation to untrusted users.\n\n### References\nThanks to Bryan Cahill for bringing this issue to our attention.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)\n* Email us at [care@weblate.org](mailto:care@weblate.org)\n\n\n## Affected packages\n\n- `weblate >= 4.14, < 5.6.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weblate 5.6.2`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}