CVE-2025-66407
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Weblate's Create Component functionality. When using the Mercurial version control system, attackers can supply malicious repository URLs to probe internal services, access cloud metadata endpoints, and enumerate local files. Only authorized users can exploit this vulnerability, affecting Weblate instances with Mercurial enabled.
💻 Affected Systems
- Weblate
📦 What is this software?
Weblate by Weblate
⚠️ Risk & Real-World Impact
Worst Case
Full environment compromise through cloud metadata credential theft, internal service enumeration leading to lateral movement, and sensitive file disclosure.
Likely Case
Internal network reconnaissance, cloud metadata access in cloud environments, and filesystem layout disclosure through error messages.
If Mitigated
Limited impact with proper network segmentation and cloud metadata service protections, though filesystem enumeration may still be possible.
🎯 Exploit Status
Exploitation requires authorized user access to Create Component functionality. The vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.15
Vendor Advisory: https://github.com/WeblateOrg/weblate/security/advisories/GHSA-hfpv-mc5v-p9mm
Restart Required: Yes
Instructions:
1. Backup your Weblate instance. 2. Update to Weblate version 5.15 or later. 3. Restart the Weblate service. 4. Verify the fix by testing repository URL validation.
🔧 Temporary Workarounds
Disable Mercurial VCS Backend
allRemove Mercurial from VCS_BACKENDS configuration to prevent exploitation
Edit Weblate settings.py and remove 'weblate.vcs.mercurial.HgRepository' from VCS_BACKENDS
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Weblate from internal services and cloud metadata endpoints
- Apply web application firewall rules to block SSRF patterns and restrict outbound connections from Weblate
🔍 How to Verify
Check if Vulnerable:
Check if Weblate version is below 5.15 and Mercurial is enabled in VCS_BACKENDSCheck Version:
weblate --versionVerify Fix Applied:
Test Create Component functionality with malicious URLs; proper versions should reject invalid protocols and not expose response content📡 Detection & Monitoring
Log Indicators:
- Unusual repository URL patterns in component creation logs
- Mercurial operations with file:// or internal IP addresses
- Error messages revealing internal service responses
Network Indicators:
- Outbound connections from Weblate to internal IP ranges
- Requests to cloud metadata endpoints from Weblate server
SIEM Query:
source="weblate" AND (url="file://*" OR url="http://169.254.169.254*" OR url="http://10.*" OR url="http://192.168.*" OR url="http://172.16.*")