Weblate versions before 5.17 allow an authenticated user to trigger a Server‑Side Request Forgery by uploading a screenshot URL that redirects. The ALLOWED_ASSET_DOMAINS setting only applies to the initial request, so any subsequent redirects can reach arbitrary hosts. This flaw can be used to access internal network resources, read sensitive data, or potentially reach services that do not expose themselves externally. The vulnerability is classified as CWE‑918.

The affected product is Weblate developed by WeblateOrg. All versions of Weblate prior to 5.17 are vulnerable. Versions 5.17 and later contain the fix that correctly enforces the asset domain restriction for all redirects.

The CVSS score for this issue is 5.0, reflecting moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated within Weblate, but once authenticated can inject arbitrary URLs that will be processed by the server. Because no external exploit is known and the impact is limited to internal resources, the overall risk is moderate, but the flaw remains significant for sites exposed to external contributors who can upload screenshots.