CVE-2026-50127

Summary

Weblate SSRF: outbound URL guard misses some private ranges

Severity

medium

CVSS

5.9

EPSS

0.3% (p23)

CWE

CWE-918

Also known as

GHSA-vmfc-9982-2m45

Published

2026-07-07

Updated

2026-07-07

Advisory details

Impact

Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

Patches

• https://github.com/WeblateOrg/weblate/pull/19768

Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

References

• https://github.com/advisories/GHSA-vmfc-9982-2m45
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-vmfc-9982-2m45
• https://nvd.nist.gov/vuln/detail/CVE-2026-50127
• https://github.com/WeblateOrg/weblate/pull/19768
• https://github.com/WeblateOrg/weblate/releases/tag/weblate-2026.6

Related advisories

• CVE-2025-68398 — critical · PyPI/weblate
• CVE-2026-34393 — high · PyPI/weblate
• CVE-2026-34242 — high · PyPI/weblate
• CVE-2026-33435 — high · PyPI/weblate
• CVE-2025-68279 — high · PyPI/weblate
• CVE-2026-55227 — medium · PyPI/weblate
• CVE-2025-66407 — medium · PyPI/weblate
• CVE-2026-45106 — medium · PyPI/weblate

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity