Weblate, a web‑based localization platform, contained an SSRF flaw in the VCS_RESTRICT_PRIVATE guard. From version 5.15 up to, but excluding, version 2026.6, the guard failed to treat several transitional IPv6 ranges, multicast addresses, and some semi‑private IPv4 ranges as private, allowing an attacker to supply a malicious URL that causes Weblate to perform outbound requests to otherwise blocked internal addresses and potentially expose internal services or sensitive data. This flaw is a classic example of CWE‑918 (Server‑Side Request Forgery).

The vulnerability affects Weblate deployments of any version between 5.15 and prior to 2026.6. The affected vendor is WeblateOrg and the product is Weblate. Administrators using these legacy releases should verify whether VCS is enabled and whether internal address restrictions are required.

The CVSS score is 5.9, indicating a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. Attackers would likely need authenticated access to configure or trigger VCS operations that resolve external URLs. In the absence of public exploits, the threat remains limited to internal network abuse, but organizations relying on strict outbound filtering should treat this as a moderate‑to‑high risk until patched.