Weblate versions older than 5.17 allow users with project.edit permission to configure machine‑translation service URLs. During configuration validation Weblate performs an HTTP request to the configured URL and includes up to 200 characters of the response in an error message shown to the user. This technique lets an attacker conduct a Server‑Side Request Forgery that reveals partial internal network responses. The weakness is a Server‑Side Request Forgery with partial response read, classified as CWE‑918 and CWE‑200, leading to potential exposure of internal resources and data loss.

The vulnerability affects the Weblate open‑source localization platform built by WeblateOrg. All deployments running any version prior to 5.17 are susceptible. Targeted versions are those before the 5.17 release, as the fix was introduced in that release.

The CVSS score of 5.0 indicates moderate severity. No EPSS value is available, so the current exploitation likelihood is uncertain, and the issue is not listed in CISA’s KEV catalog. The attacker must possess project.edit rights, which can be granted by the per‑project Administration role. If such a user can set arbitrary machinery URLs, they can initiate SSRF against internal hosts that are reachable from the Weblate server. Because the response is partially reflected, the impact is limited to exposure of displayed content rather than full network compromise, but still sufficient to leak sensitive or confidential data.