---
id: CVE-2026-50127
aliases:
  - GHSA-vmfc-9982-2m45
title: 'Weblate SSRF: outbound URL guard misses some private ranges'
summary: 'Weblate SSRF: outbound URL guard misses some private ranges'
severity: medium
cvss: 5.9
cwe:
  - CWE-918
vendor: weblate
product: weblate
ecosystem: pip
affected:
  - 'weblate >= 5.15, < 2026.6'
patched:
  - weblate 2026.6
published: '2026-07-07'
updated: '2026-07-07'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-vmfc-9982-2m45'
references:
  - url: >-
      https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50127'
  - url: 'https://github.com/WeblateOrg/weblate/pull/19768'
  - url: 'https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6'
  - url: 'https://github.com/advisories/GHSA-vmfc-9982-2m45'
tags:
  - ghsa
  - pip
epss: 0.00471
epssPercentile: 0.38014
ingestedAt: '2026-07-08T00:44:25.696Z'
---

## Overview

### Impact

Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

### Patches

* https://github.com/WeblateOrg/weblate/pull/19768

### Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

## Affected packages

- `weblate >= 5.15, < 2026.6`

## Remediation

Upgrade to a patched release:

- `weblate 2026.6`