Weblate Remote Code Execution Vulnerability During Backup Restoration

A remote code execution vulnerability has been identified in Weblate, a web-based localization tool, in versions prior to 5.17. The issue arises because the project backup feature did not properly filter Git and Mercurial configuration files, potentially allowing for remote code execution under certain circumstances. This vulnerability is only accessible to users who can create projects.

Impact

Exploitation of this vulnerability could lead to remote code execution on the server where Weblate is hosted.

Remediation

Users can update to Weblate version 5.17, where this vulnerability has been patched. If an immediate update is not possible, access to the project backup can be restricted, limiting the vulnerability's scope.