CVE-2025-68398 json
Weblate has git config file overwrite vulnerability that leads to remote code execution
published 10mo ago modified last mo. also EUVD-2025-204419 , GHSA-8vcg-cfxj-p5m3 , PYSEC-2026-571
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Patch / fix
- pypi weblate 5.15.1
- weblate weblate 5.15.1
- weblate openSUSE Tumbleweed 5.14.3-2.1
opensuse advisories openSUSE-SU-2025:15853-1
- github.com/WeblateOrg/weblate@4837a41 commit
- github.com/WeblateOrg/weblate@dd8c9d7 commit
- github.com/WeblateOrg/weblate#17330 pull request
- github.com/WeblateOrg/weblate#17345 pull request
- github.com/WeblateOrg/weblate/releases/tag/weblate-5.15.1 release
Is CVE-2025-68398 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 10mo ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | weblate | <5.15.1 |
5.15.1 |
Affected products
- WeblateOrg weblate
Classification
References
-
github.com
/WeblateOrg/weblate/pull/17330
web, issue-tracking
-
github.com
/WeblateOrg/weblate/pull/17345
web, issue-tracking
-
github.com
/WeblateOrg/weblate/commit/4837a4154390f7c1d03c0e398aa6439dcfa361b4
web
-
github.com
/WeblateOrg/weblate/commit/dd8c9d7b00eebe28770fa0e2cd96126791765ea7
web
-
github.com
/WeblateOrg/weblate/security/advisories/GHSA-8vcg-cfxj-p5m3
web, vendor-advisory
-
github.com
/WeblateOrg/weblate/releases/tag/weblate-5.15.1
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-68398
advisory
-
github.com
/WeblateOrg/weblate
package
-
pypi.org
/project/weblate
package
-
github.com
/advisories/GHSA-8vcg-cfxj-p5m3
advisory
Sources
- CVE List CVE-2025-68398
- GitHub Advisory GHSA-8vcg-cfxj-p5m3
- NVD CVE-2025-68398
- OSV PYSEC-2026-571
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.