A critical vulnerability in Weblate allows authenticated users with project creation privileges to achieve remote code execution through improper backup file handling.

This vulnerability involves a combination of relative path traversal and improper control of code generation. The flaw allows an attacker with high privileges, specifically those permitted to create projects, to manipulate Git or Mercurial configuration files during the backup process, resulting in remote code execution.

The ability to achieve remote code execution poses a severe risk to the confidentiality, integrity, and availability of the Weblate instance and the underlying server. With a CVSS score of 8.0, this high-severity flaw could allow an attacker to gain full control over the localization environment, potentially leading to unauthorized data exfiltration or total system compromise.

Immediate Action: Upgrade Weblate to version 5.17 or later to implement the necessary filtering for backup configuration files.

Proactive Monitoring: Review system access logs for any suspicious activity related to project backup creation or unauthorized configuration file modification.

Compensating Controls: If an immediate upgrade is not feasible, restrict project creation capabilities to highly trusted users to minimize the attack surface until the patch is applied.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations should prioritize upgrading their Weblate installations to version 5.17 immediately. Administrators must verify that their backup processes are no longer susceptible to configuration file injection and ensure that user roles are strictly managed to prevent unauthorized access to project creation features.