CVE-2026-39845 — Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If …
Published: 2026-04-15 · CVSS: 4.1 · CVSS 3.1
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7