The flaw resides in earlier releases of Weblate where the ZIP download process did not validate the location of extracted files. An attacker could supply or manipulate a zip archive containing symbolic links that point to files outside the repository, allowing that archive to be extracted and the files read by the Weblate service. This can lead to disclosure of any file on the system that the Weblate process can access, such as configuration files, credentials, or other sensitive data.

Vendors: WeblateOrg; product: Weblate. Versions affected are all releases prior to 5.17. The issue was addressed in version 5.17 and later.

The CVSS score of 7.7 indicates a high severity for confidentiality. Exploitation is likely conducted through the web interface’s ZIP download feature, making it a remote attack vector. No exploit probability data is available and the vulnerability is not listed in the KEV catalog, but the high severity and remote nature mean that exposed installations face a significant risk of confidential data disclosure.