CVE-2026-61792

Executive Summary

CVE-2026-61792 is a path traversal vulnerability in Weblate, a web-based continuous localization platform, affecting all versions prior to 2026.7. A project administrator can leverage the App store metadata download feature to read arbitrary files on the Weblate host that reside outside the project's repository, resulting in a high confidentiality impact (CVSS 7.7). This vulnerability represents an incomplete fix for CVE-2026-34242, indicating that the original remediation failed to fully contain attacker-controlled path resolution within repository boundaries.

Technical Analysis

The vulnerability resides in Weblate's App store metadata download feature, a functionality that resolves file paths influenced by project administrators. The core flaw is a path traversal vulnerability (CWE-22) where the application resolves user-controlled paths without adequately confining them to the designated repository directory.

Vulnerability Mechanism:

The application accepts an input path from a project administrator, which is used to retrieve metadata files. Due to insufficient path sanitization and inadequate confinement logic, the resolved path can escape the intended repository root using traversal sequences (e.g., ../ or absolute path references). Because the download feature fails to validate that the final resolved path remains within the repository's directory structure, an attacker can point the metadata retrieval to arbitrary files on the host filesystem.

Attack Surface:

• Authentication Required: Low (project-administrator privileges required)
• Network Vector: The vulnerability is exploitable over the network via the web interface
• Scope Changed: The CVSS vector includes S:C, indicating the compromised component (repository metadata retrieval) impacts resources beyond its security scope (the host filesystem)

Incomplete Patch Analysis:

The NVD description explicitly states this is an incomplete fix for CVE-2026-34242. The original patch for CVE-2026-34242 failed to fully prevent path traversal, suggesting that the initial remediation may have blocked certain traversal patterns but missed others (e.g., encoding bypasses, double-encoding, symbolic link resolution, or alternative absolute path references). This underscores that naive path validation without canonicalization is often insufficient.

Technical Detail Gap:

Insufficient technical detail is available in the NVD description to identify specific function names, URL endpoints, or parameter identifiers. The attack mechanism is described at the class level: attacker-influenced paths are resolved without being confined to the intended repository directory.

Exploitation Scenarios

Since no public PoC or exploit code is available, the attack chain is inferred from the vulnerability class and the NVD description.

1) Reconnaissance / Target Identification:

• Attacker identifies an exposed Weblate instance (versions < 2026.7) through internet-wide scanning (e.g., Shodan queries for Weblate HTTP banners)
• Attacker obtains or compromises project-administrator credentials through phishing, credential stuffing, or lateral movement within an organization that uses Weblate

2) Triggering the Flaw:

• Authenticated as a project administrator, the attacker navigates to the App store metadata download feature
• The attacker crafts a request where the file path parameter includes path traversal sequences (e.g., ../../../../etc/passwd) or uses an absolute path pointing outside the repository root

3) Payload / Execution Method:

• The application resolves the attacker-influenced path without adequately verifying that the canonical path remains within the repository directory
• The server returns the contents of the requested file as a download response

4) Post-Exploitation Impact:

• File disclosure of sensitive host system files, including but not limited to:
  • /etc/passwd — user account enumeration
  • /etc/shadow (if permissions allow) — password hashes
  • Weblate configuration files — database credentials, secret keys, SMTP credentials
  • Web server configuration files
  • Potentially other mounted volumes accessible to the Weblate process user

Impact Assessment

CVSS Analysis (Score: 7.7, High):

• Attack Vector (AV:N): Exploitable remotely over the network
• Attack Complexity (AC:L): No special conditions required beyond valid credentials
• Privileges Required (PR:L): Low — project-administrator access required
• User Interaction (UI:N): None required
• Scope (S:C): The compromised component (repository metadata feature) impacts resources in a different security scope (host filesystem)
• Confidentiality (C:H): High — arbitrary file read capability
• Integrity (I:N): None
• Availability (A:N): None

Business Impact:

• Data Exfiltration: Sensitive configuration files, credentials, and proprietary data can be exfiltrated, leading to downstream compromise of the Weblate host and connected systems
• Credential Theft: Access to database credentials and secret keys enables further attacks, including database compromise and session forgery
• Compliance Violations: If the host filesystem contains regulated data (PII, PHI), this vulnerability may constitute a reportable breach
• Blast Radius: Any file readable by the Weblate process user is exposed. This typically includes application configuration, environment files, and potentially system files depending on process privileges

Affected Systems: All Weblate deployments running versions prior to 2026.7, particularly those with:

• Multi-tenant or self-hosted configurations
• Multiple projects with distinct administrator roles
• Sensitive data stored on the same host as the Weblate application

Detection Guidance

Sigma Rule

title: Weblate Path Traversal via App Store Metadata Download
id: 3c7e9f2a-8b4d-4e6f-9a1c-2d5e8f0a7b6c
status: experimental
description: Detects path traversal attempts targeting Weblate App store metadata download feature
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method:
      - 'GET'
      - 'POST'
    cs-uri-query|contains:
      - '..%2f'
      - '..%252f'
      - '%2e%2e%2f'
      - '....//'
      - '..%5c'
      - '/etc/'
      - '/proc/'
      - '/var/'
  filter_known:
    cs-uri-query|contains:
      - '/static/'
      - '/media/'
  condition: selection and not filter_known
falsepositives:
  - Legitimate file requests with similar patterns in filenames
level: high
tags:
  - attack.t1213
  - cve.2026-61792
  - cwe.22

YARA Rule

rule Weblate_Path_Traversal_CVE_2026_61792
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal payloads targeting Weblate App store metadata download"
        cve = "CVE-2026-61792"
        date = "2026-01-15"
        severity = "high"
    strings:
        $a = "../" ascii
        $b = "..\\" ascii
        $c = "%2e%2e" ascii nocase
        $d = "%2E%2E" ascii
        $e = "....//" ascii
        $f = "..%252f" ascii
        $g = "appstore" ascii nocase
        $h = "app_store" ascii nocase
        $i = "metadata" ascii nocase
        $j = "download" ascii nocase
    condition:
        uint16(0) == 0x4D5A or filesize < 10MB and
        (any of ($a..$f)) and (any of ($g..$j))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Weblate Path Traversal via App Store Metadata Download (CVE-2026-61792)"; flow:to_server,established; content:"GET"; http_method; content:"./"; http_uri; content:"../"; http_uri; content:"metadata"; http_uri; nocase; content:"download"; http_uri; nocase; pcre:"/(?:%2e%2e|%252e%252e|\.\.)/i"; reference:cve,2026-61792; classtype:attempted-user; sid:2026061792; rev:1;)

Elastic Detection

detection-rule:
  name: Weblate Path Traversal via App Store Metadata Download
  severity: high
  type: correlation
  index:
    - filebeat-*
    - auditbeat-*
  eql:
    sequence by host.id
      [network where destination.port in (80, 443) and process.name == "wsgi" or process.name == "gunicorn"]
      [any where (event.module == "apache" or event.module == "nginx")
        and url.path contains "metadata"
        and (
          url.path contains "../" or
          url.path contains "..\\" or
          url.path contains "%2e%2e" or
          url.path contains "/etc/" or
          url.path contains "/proc/" or
          url.path contains "/var/"
        )]
  alert:
    event.action: correlate
    severity: high
    tags:
      - cve-2026-61792
      - cwe-22
      - path-traversal

Splunk SPL Query

index=web OR index=proxy OR index=weblate* 
  earliest=-24h
| where 
    match(uri_path, "(?i).*(appstore|metadata).*") AND
    ( 
      uri_path LIKE "%..%" OR 
      uri_path LIKE "%252e%" OR 
      uri_path LIKE "%2e%2e%" OR 
      uri_path LIKE "%252f%" OR
      uri_path LIKE "%etc%" AND uri_path LIKE "%passwd%" OR
      uri_path LIKE "%proc%" AND uri_path LIKE "%self%"
    )
| stats count by src_ip, uri_path, cs_username, host
| sort -count

Wazuh OSSEC Rule

<group name="local, weblate,">
  <rule id="100617" level="12">
    <decoded_as>web</decoded_as>
    <description>Weblate path traversal attempt via App store metadata download (CVE-2026-61792)</description>
    <url>https://nvd.nist.gov/vuln/detail/CVE-2026-61792</url>
    <group>attack.t1213,cwe.22,path_traversal,weblate,</group>
    <regex>url \S+metadata\S*.*(\%2e\%2e|\.\.(\/|\\)|etc\/passwd|proc\/self)</regex>
    <regex offset="3">url \S+metadata\S*.*(\%2e\%2e|\.\.(\/|\\)|etc\/passwd|proc\/self)</regex>
    <if_sid>31100,31500,31101</if_sid>
    <options>no_full_log</options>
    <mitre>
      <id>0</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence has been identified from any tracked source at the time of writing. However, the NVD description explicitly states the issue is fixed in version 2026.7.

1) Immediate Mitigations

• Upgrade to Weblate 2026.7 or later — this is the only confirmed remediation
• If immediate upgrade is not feasible:
  • Restrict project-administrator privileges — minimize the number of users with project-administrator roles
  • Network segmentation — place Weblate behind an internal network boundary or VPN, preventing external attackers from reaching the web interface
  • Web application firewall (WAF) — deploy WAF rules blocking path traversal payloads targeting the App store metadata download endpoint (refer to the Suricata rule patterns above)
  • File system permissions — run the Weblate process with the principle of least privilege, ensuring the process user can only read files necessary for application operation
  • Monitoring — deploy detection rules provided above to identify exploitation attempts

2) Patch / Upgrade Steps

1. Review current Weblate version: weblate --version or via the administration interface
2. Back up the Weblate database and configuration files
3. Upgrade to the latest release (2026.7 or newer) following the official Weblate upgrade documentation
4. Verify the upgrade: confirm version number reflects 2026.7+
5. Perform post-upgrade regression testing of the App store metadata download functionality

3) Long-term Hardening

• Disable the App store metadata download feature if not actively used by project administrators
• Implement filesystem-level restrictions — use containerization (Docker) or chroot/jail environments to confine the Weblate process
• Regular security reviews — audit project-administrator accounts and their activity logs
• Patch management — track CVEs related to Weblate closely, as this is the second consecutive CVE affecting the same feature (predecessor: CVE-2026-34242)
• Change any credentials that may be present in exposed files if exploitation is suspected

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-61792
2. Related CVE (Incomplete Fix): https://nvd.nist.gov/vuln/detail/CVE-2026-34242 — the original vulnerability for which this CVE is an incomplete fix
3. Weblate Official Site: https://weblate.org/ — vendor page for version updates and release announcements
4. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html — vulnerability class technical background
5. CISA Known Exploited Vulnerabilities (KEV): Not listed — no evidence of in-the-wild exploitation at the time of writing

Threat Actor Campaigns: No known active campaigns exploiting this CVE have been identified. The vulnerability requires authenticated project-administrator access, which reduces the likelihood of mass exploitation.

Exploit-in-the-Wild: No public evidence of exploitation in the wild has been reported.