Weblate is a web-based localization platform. CVE-2026-33440 affects Weblate versions prior to 5.17 and relates to the ALLOWED_ASSET_DOMAINS setting not being consistently enforced when fetching remote assets via redirects. In plain terms: an attacker could potentially cause Weblate to follow a redirect to a domain that is not allowed, bypassing the intended domain allowlist for asset/image fetching.
Technically, the issue is described as ALLOWED_ASSET_DOMAINS applying only to the first issued requests and not restricting possible redirects. The fix is present in Weblate 5.17. The referenced commit shows changes in the screenshot image URL validation/download path: the previous implementation used validate_host(urlparse(url).hostname or "", settings.ALLOWED_ASSET_DOMAINS) before making a request via http_request("get", url, stream=True). The updated code routes the request through weblate.utils.requests.asset_request("get", url, stream=True) and introduces a helper (raise_image_url_error) used for validation errors. This indicates the allowlist enforcement was moved/centralized into the asset_request mechanism so that redirect handling is constrained as well, rather than only validating the initial hostname.
Impact: Because the allowlist was not enforced across redirects, an attacker who can influence the remote asset URL (e.g., an image URL field that Weblate attempts to download) may be able to make Weblate fetch content from an unintended domain. The NVD severity is medium with CVSS 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), suggesting the primary concern is limited confidentiality impact (C:L) with no integrity or availability impact indicated by the scoring. The blast radius is scoped (S:C) meaning the vulnerable component’s behavior can affect resources beyond its security scope, but the exact real-world consequences (e.g., whether sensitive internal resources could be reached) are not detailed in the provided references.
Mitigation: Upgrade Weblate to version 5.17 or later, where the redirect bypass for ALLOWED_ASSET_DOMAINS has been fixed. If upgrading is not immediately possible, the provided references do not include a specific workaround or configuration-only mitigation beyond ensuring the application uses the fixed request/validation behavior. For detection guidance, focus on monitoring for user-supplied asset/image URLs that trigger HTTP redirects during asset fetching, especially where the final redirected domain is not within ALLOWED_ASSET_DOMAINS.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-918