PYSEC-2026-3416
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/weblate/PYSEC-2026-3416.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3416
- Aliases
- Published
- 2026-07-13T15:46:29.565097Z
- Modified
- 2026-07-13T16:32:10.367257081Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Weblate SSRF: outbound URL guard misses some private ranges
- Details
-
Impact
Weblate's
VCS_RESTRICT_PRIVATEdid not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.Patches
- https://github.com/WeblateOrg/weblate/pull/19768
Resources
The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.
- References
-
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45
- https://nvd.nist.gov/vuln/detail/CVE-2026-50127
- https://github.com/WeblateOrg/weblate/pull/19768
- https://github.com/WeblateOrg/weblate
- https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6
- https://pypi.org/project/weblate
- https://github.com/advisories/GHSA-vmfc-9982-2m45
Affected packages
PyPI / weblate
Package
- Name
- weblate
- View open source insights on deps.dev
- Purl
- pkg:pypi/weblate