Weblate's backup functionality in versions before 5.17 fails to sanitize Git and Mercurial configuration files, allowing an attacker to craft a payload that is executed when the backup is restored. This flaw enables remote code execution on the system hosting Weblate, potentially granting full system compromise. The weakness involves path traversal and arbitrary code inclusion, classified under CWEs 23, 434, and 94.

The affected product is Weblate, provided by WeblateOrg. Vulnerable versions are all releases older than 5.17. Users running those versions should verify their current build and consider an upgrade.

The vulnerability carries a CVSS score of 8.1, indicating high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The exploit requires remote access to the project backup endpoint, which is only available to users who have project‑creation permissions, making the attack vector feasible for authenticated users within the Weblate installation. Inferred that an attacker could place malicious configuration files in a project repository and trigger RCE during a backup restore performed by a privileged user.