🎯 New Report #3518571: Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on Weblate
🔺Severity: null
👽 Reporter: alexb 616
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-01-20
⏰ Disclosed: 2026-04-26 13:21:45
📝 Summary: A vulnerability was discovered in the SSH management interface of Weblate, a web-based translation tool. The vulnerability allowed an attacker with administrative privileges to inject command-line arguments into the host parameter, leading to sensitive file disclosure on the server. The vulnerable code was found in the ssh() function, where the host parameter was directly appended to a subprocess command without proper sanitization, enabling the attacker to read files like /etc/passwd, Django settings.py, and private SSH keys.
📂 Report JSON File: 3518571
@hackeronereports