{"id":"CVE-2025-68398","title":"Weblate is a web based localization tool","summary":"Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-20","CWE-22","CWE-434"],"vendor":"weblate","product":"weblate","affected":["weblate < 5.15.1"],"patched":["weblate 5.15.1"],"published":"2025-12-18","updated":"2026-09-30","sourceUpdated":"2026-09-30T23:10:00.237","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68398","references":[{"url":"https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4","label":"security-advisories@github.com"},{"url":"https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7","label":"security-advisories@github.com"},{"url":"https://github.com/WeblateOrg/weblate/pull/17330","label":"security-advisories@github.com"},{"url":"https://github.com/WeblateOrg/weblate/pull/17345","label":"security-advisories@github.com"},{"url":"https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1","label":"security-advisories@github.com"},{"url":"https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00792,"epssPercentile":0.54726,"ingestedAt":"2026-09-30T23:29:32.506Z","slug":"CVE-2025-68398","body":"## Overview\n\nWeblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.\n\n## Affected\n\n- `weblate < 5.15.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `weblate 5.15.1`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}