CVE-2026-86035

HIGH 8.5

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

CVSS Score

8.5

EPSS Score

0.0%

EPSS Percentile

0th

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.

CWE	CWE-78 CWE-88
Vendor	weblateorg
Product	weblate
Published	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for weblateorg weblate

Be the first to know when new high vulnerabilities affecting weblateorg weblate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

WeblateOrg / weblate

>= 4.11.1, < 2026.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-327h-qqgm-qv55 github.com: https://github.com/WeblateOrg/weblate/pull/20768 github.com: https://github.com/WeblateOrg/weblate/commit/f60a9759a6d851bd10ccdefe9b1b7f0cdb9e9bbd github.com: https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.8