CVE-2025-68398

critical

Description

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

References

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3

https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1

https://github.com/WeblateOrg/weblate/pull/17345

https://github.com/WeblateOrg/weblate/pull/17330

https://github.com/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7

https://github.com/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4

Details

Source: Mitre, NVD

Published: 2025-12-18

Updated: 2026-02-06

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00106

Detections

Analytics