The vulnerability exists in Weblate versions before 2026.8. Users who can manage component repository URLs can trigger server‑side request forgery through DNS rebinding during VCS operations. Weblate initially resolves the hostname for the chosen repository, but the external VCS client then performs a second DNS lookup. An attacker can point the hostname first to a public address and later rebind it to an internal or private address, causing Weblate to connect to an internal VCS‑compatible service. The result is that sensitive repository contents or other internal resources might be exposed to the attacker. This is a classic SSRF event built on DNS rebinding (CWE‑367) and server‑side request forgery (CWE‑918).

The affected product is Weblate, the web‑based continuous localization platform from WeblateOrg. All installations using Weblate versions prior to 2026.8 that allow untrusted repository hostnames while VCS_RESTRICT_PRIVATE is set to true are vulnerable. The fix is included in release 2026.8. No other product or vendor is listed.

The CVSS score of 3.5 indicates a low severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not actively exploited in the wild. Nevertheless, the attack path requires the attacker to control repository URLs or influence the VCS configuration, which is typically limited to users with component‑repository‑management privileges. Once such a user defines a malicious URL, Weblate can be compelled to contact internal hosts, potentially leaking private data. Although the impact score is low, the internal exposure risk can be significant for environments that expose critical repositories or services.