CVE-2026-33435: 
Python vulnerability analysis and mitigation

CVE-2026-33435 is a remote code execution vulnerability in Weblate, a web-based localization tool, caused by the project backup functionality failing to filter Git and Mercurial configuration files during restoration. All Weblate versions prior to 5.17 are affected. The vulnerability was reported by security researcher ggamno via HackerOne, published on April 15, 2026, and patched in version 5.17. It carries a CVSS v3.1 base score of 8.0 (High) (GitHub Advisory, Weblate Security Advisory).

The root cause is a combination of relative path traversal (CWE-23), code injection (CWE-94), and unrestricted upload of dangerous file types (CWE-434) in Weblate's backup restoration logic (weblate/trans/backups.py). During backup restoration, the application extracted archive contents without filtering or sanitizing VCS configuration files such as .git/config, .git/config.worktree, .hg/hgrc, and files under .git/hooks/. An attacker could craft a malicious backup ZIP containing weaponized Git hooks or Mercurial configuration directives that execute arbitrary commands when the repository is subsequently used by the Weblate server process. Exploitation requires the attacker to have project creation privileges and the ability to trigger a backup restoration (GitHub Advisory, Fix PR #18549).

Successful exploitation allows an authenticated attacker with project creation privileges to achieve remote code execution on the Weblate server, resulting in full compromise of confidentiality, integrity, and availability. An attacker could access sensitive data stored on the server (including translation content, credentials, and repository data), modify or destroy localization projects, and potentially pivot laterally within the hosting infrastructure. The CVSS scope is marked as "Changed," indicating that the impact extends beyond the vulnerable Weblate component itself (GitHub Advisory, Weblate Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.114% (30th percentile), indicating a low near-term exploitation probability. Exploitation is constrained by the requirement for high privileges (project creation access) and high attack complexity, limiting the realistic attacker pool to trusted but malicious insiders or compromised privileged accounts.

1. Obtain project creation privileges: Gain access to a Weblate account with project creation rights, either through legitimate credentials, credential theft, or social engineering.
2. Craft a malicious backup archive: Create a ZIP file mimicking a valid Weblate project backup, but embed malicious VCS configuration files — for example, a .git/hooks/post-checkout or .git/config file containing shell commands (e.g., a reverse shell payload) that will execute when Git operations are performed.
3. Initiate backup restoration: Use the Weblate project backup restore functionality (accessible to project creators) to upload and restore the crafted malicious backup archive.
4. Trigger hook/config execution: Once the backup is restored, the malicious .git/hooks/ scripts or configuration directives are written to disk without sanitization. Any subsequent Git operation performed by the Weblate server process (e.g., a pull, push, or checkout) triggers the embedded hook, executing the attacker's payload as the Weblate service account.
5. Achieve remote code execution: The attacker's commands run on the server, enabling data exfiltration, persistence establishment, or lateral movement within the infrastructure (Weblate Security Advisory, Fix PR #18549).

• File System: Presence of unexpected or recently modified files at .git/config, .git/config.worktree, .git/hooks/*, or .hg/hgrc within Weblate's repository directories following a backup restoration event; executable scripts in .git/hooks/ with unusual content or timestamps.
• Process: Unexpected child processes spawned by the Weblate service account (e.g., bash, sh, curl, wget, python) following Git operations; outbound network connections initiated by the Weblate process to unknown external hosts.
• Logs: Weblate application logs showing backup restoration activity by a project-creator account, especially if followed by VCS operation errors or anomalous subprocess execution; system audit logs recording file creation events in .git/hooks/ directories.
• Network: Unusual outbound connections from the Weblate server to external IPs shortly after a backup restore operation, potentially indicating reverse shell or data exfiltration activity.

Upgrade Weblate to version 5.17 or later, which fixes the issue by skipping extraction of .git/config, .git/config.worktree, .hg/hgrc, and all .git/hooks/ paths during backup restoration, and then reconfiguring repositories from the actual component settings (Fix PR #18549). As a temporary workaround for installations that cannot immediately upgrade, restrict project creation privileges to only fully trusted users, since the backup restore feature is only accessible to users who can create projects (Weblate Security Advisory). Additionally, monitor backup restoration operations and audit VCS configuration file changes as a compensating control.

The vulnerability was reported through HackerOne by researcher ggamno and was publicly disclosed by Weblate maintainer nijel on April 15, 2026. Social media activity was limited but included mentions on Mastodon and Bluesky shortly after disclosure. The NixOS/nixpkgs project tracked the issue and opened a corresponding update ticket (NixOS/nixpkgs#510516) to update the Weblate package (Fix PR #18549).