An improper file handling vulnerability in Weblate allows authenticated attackers to perform path traversal and access unauthorized system files, posing a high risk to data confidentiality.

The vulnerability stems from improper validation of files during the ZIP download process, specifically involving path traversal (CWE-22) and improper link resolution (CWE-59). An authenticated user with low privileges can exploit this to follow symlinks and access sensitive information outside of the intended directory.

This flaw facilitates the unauthorized disclosure of sensitive data, which could lead to a significant breach of confidentiality regarding project files or internal system configurations. Given the CVSS score of 7.7, this vulnerability is categorized as High severity, necessitating prompt remediation to protect the integrity of the localization environment and the data contained within.

Immediate Action: Update Weblate to version 5.17 or later to implement the necessary security checks on ZIP file handling.

Proactive Monitoring: Review access logs for unusual file request patterns or attempts to traverse directories, particularly focusing on the ZIP download functionality.

Compensating Controls: Implement file system sandboxing or restrict the web application process permissions to minimize the impact of path traversal attempts if an immediate update is not feasible.

Public Exploit Available: Unknown

The risk associated with this path traversal vulnerability is elevated due to the potential for unauthorized sensitive data exposure. IT administrators should prioritize upgrading to version 5.17 immediately to eliminate the underlying flaw, as this is the only definitive way to secure the installation against this specific vector.