CVE-2026-21889

HIGH

7.5

Descricao

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado1/14/2026

Ultima modificacao1/23/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

weblate:weblate

Fraquezas (CWE)

CWE-284

Referencias

https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47(security-advisories@github.com)

https://github.com/WeblateOrg/weblate/pull/17516(security-advisories@github.com)

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.