Weblate ZIP Download Feature Symlink Follow Vulnerability Allowing Arbitrary File Read

A vulnerability in Weblate's ZIP download feature, present in versions prior to 5.17, allowed downloaded files to be unverified, potentially following symlinks to locations outside the repository. This issue could lead to arbitrary file read vulnerabilities.

Impact

Exploitation of this vulnerability could result in arbitrary file read, with the potential to access files outside of the intended directory.

Reproduction

The vulnerability can be reproduced by creating a symlinked file outside of the repository and linking it within the component's directory. When the ZIP file is downloaded, the unverified symlink will be followed, allowing access to the file outside the repository.

Remediation

Users can update to Weblate version 5.17 or later, where this vulnerability has been fixed.