CVE-2026-86035

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86035

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86035.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86035

Aliases

GHSA-327h-qqgm-qv55

Published

2026-09-29T14:58:20Z

Modified

2026-09-30T03:48:09Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Details

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78",
        "CWE-88"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86035.json"
}

References

Affected packages

Git / github.com/weblateorg/weblate

Affected ranges

Type

GIT

Repo

https://github.com/weblateorg/weblate

Events

Introduced

c17dbfb45f4ce50ee0e07b9519512c5a9a9313c6

Fixed

b924fd613e7e3bb93e2f0ff5640ee82b5d3620a5

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "4.11.1"
        },
        {
            "fixed":  "2026.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

weblate-2026.*

weblate-2026.5

weblate-2026.6

weblate-2026.7

weblate-2026.7.1

weblate-4.*

weblate-4.11.1

weblate-4.11.2

weblate-4.12

weblate-4.12.1

weblate-4.13

weblate-4.13.1

weblate-4.14

weblate-4.14.1

weblate-4.14.2

weblate-4.15

weblate-4.15.1

weblate-4.16

weblate-4.16.1

weblate-4.16.2

weblate-4.17

weblate-4.18

weblate-4.18.1

weblate-5.*

weblate-5.0.1

weblate-5.0.2

weblate-5.1

weblate-5.1.1

weblate-5.10

weblate-5.10.1

weblate-5.10.2

weblate-5.10.3

weblate-5.11

weblate-5.11.1

weblate-5.12

weblate-5.12.1

weblate-5.12.2

weblate-5.13

weblate-5.13.1

weblate-5.13.2

weblate-5.14

weblate-5.14.1

weblate-5.15

weblate-5.15.1

weblate-5.15.2

weblate-5.16

weblate-5.16.1

weblate-5.17

weblate-5.17.1

weblate-5.2

weblate-5.2.1

weblate-5.3

weblate-5.4

weblate-5.5

weblate-5.5.1

weblate-5.5.2

weblate-5.5.3

weblate-5.5.4

weblate-5.5.5

weblate-5.6

weblate-5.6.1

weblate-5.7

weblate-5.7.1

weblate-5.7.2

weblate-5.8

weblate-5.8.1

weblate-5.8.2

weblate-5.9

weblate-5.9.1

weblate-5.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86035.json"