Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

WeblateOrg/weblate

              main @ 842695b
            

129

Fixes

CVEs

CRITICAL

Peak severity

20.7%

Coverage

Highlights

Auth Bypass: 60 prior fixes. Scrutinize any change in this area.

weblate/auth/permissions.py: most-fixed (16 issues). Treat as high-risk during review.

83 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring pattern of missing or mis-scoped permission checks across API, views, and templates, allowing unauthorized actions on translations, source units, and repository operations.

SSRF: Multiple SSRF vectors through VCS URLs, outbound HTTP, and project web URLs, with bypasses via DNS rebinding, IPv6 transition addresses, and hostname suffix mismatches.

Path Traversal: Path traversal and symlink following in ZIP extraction, file reads, and add-on file operations, with bypasses via case sensitivity, backslashes, and symlinks.