← Vulnerability feed

Vulnerability record · CVE-2022-23915 · published 4 March 2022

CVE-2022-23915: Weblate argument injection vulnerability

Weblate · Weblate

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

8.8 CVSS 3.1 High EPSS 3.9% · top 10.2% CWE-88 · Argument injection
8.8CVSS 3.1 base score, v2 6.5
3.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/WeblateOrg/weblate/pull/7337 PatchThird Party Advisory
https://github.com/WeblateOrg/weblate/pull/7338 PatchThird Party Advisory
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1 PatchRelease NotesThird Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088 PatchThird Party Advisory
https://github.com/WeblateOrg/weblate/pull/7337 PatchThird Party Advisory
https://github.com/WeblateOrg/weblate/pull/7338 PatchThird Party Advisory
https://github.com/WeblateOrg/weblate/releases/tag/weblate-4.11.1 PatchRelease NotesThird Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088 PatchThird Party Advisory

Track CVE-2022-23915 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-24126Weblate argument injection vulnerabilityWeblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key…EPSS 0.47%9.1CVE-2025-68398Weblate improper input validation vulnerabilityWeblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of i…EPSS 0.79%8.8CVE-2026-34393Weblate improper privilege management vulnerabilityWeblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This is…EPSS 0.54%8.0CVE-2026-33435Weblate relative path traversal vulnerabilityWeblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which cou…EPSS 0.88%7.7CVE-2026-34242Weblate path traversal vulnerabilityWeblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following s…EPSS 0.53%7.5CVE-2025-32021Weblate vulnerabilityWeblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repo…EPSS 0.38%6.8CVE-2026-33220Weblate path traversal vulnerabilityWeblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't pe…EPSS 0.39%6.5CVE-2025-68279Weblate path traversal vulnerabilityWeblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using craf…EPSS 0.41%

Source: NIST National Vulnerability Database (record CVE-2022-23915), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.