CVE-2025-61587
📋 TL;DR
This CVE describes an open redirect vulnerability in Weblate versions 5.13.2 and below when configured with Anubis and REDIRECT_DOMAINS is not set. Attackers can craft malicious URLs that redirect users from legitimate Weblate domains to attacker-controlled sites, potentially enabling phishing attacks or drive-by downloads. Organizations running vulnerable Weblate instances with specific configurations are affected.
💻 Affected Systems
- Weblate
📦 What is this software?
Weblate by Weblate
⚠️ Risk & Real-World Impact
Worst Case
Users are redirected to malicious sites that deliver malware via drive-by downloads, leading to system compromise, credential theft, or ransomware infection.
Likely Case
Phishing attacks where users are tricked into visiting fake login pages or malicious sites, potentially leading to credential harvesting.
If Mitigated
Redirects are blocked or users are warned about external links, minimizing the risk of successful attacks.
🎯 Exploit Status
Exploitation requires crafting a malicious URL with the redir parameter
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.13.3
Vendor Advisory: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99
Restart Required: Yes
Instructions:
1. Backup your Weblate instance. 2. Update to version 5.13.3 or later using your package manager or Docker. 3. Restart the Weblate service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Set REDIRECT_DOMAINS
allConfigure REDIRECT_DOMAINS environment variable to restrict allowed redirect domains
export REDIRECT_DOMAINS=yourdomain.com
Disable Anubis Integration
allRemove or disable Anubis configuration if not required
Modify Weblate configuration to remove Anubis settings
🧯 If You Can't Patch
- Implement web application firewall rules to block URLs containing suspicious redir parameters
- Configure reverse proxy to validate and sanitize redirect URLs before reaching Weblate
🔍 How to Verify
Check if Vulnerable:
Check Weblate version and configuration: 1. Verify version is 5.13.2 or below. 2. Check if Anubis is configured. 3. Verify REDIRECT_DOMAINS is not set.Check Version:
weblate --versionVerify Fix Applied:
1. Confirm version is 5.13.3 or higher. 2. Test that redirects to external domains are blocked or properly validated.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with redir parameter pointing to external domains
- Unusual redirect patterns in access logs
Network Indicators:
- Outbound connections to unexpected domains following Weblate redirects
SIEM Query:
source="weblate" AND (url="*redir=*" OR status=302 OR status=301)🔗 References
- https://github.com/WeblateOrg/docker/commit/76518342f65b8af8c2b7f7c5d37f84813c1253a1
- https://github.com/WeblateOrg/weblate/commit/6b3d73a310279b5630bca8cbd9ea0be28bc67b63
- https://github.com/WeblateOrg/weblate/commit/ec3b900f8a52c5c992d9e7014f09397e159ac381
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3xhv-r4gx-xw99
