What is GHSA-3g2f-4rjg-9385?

GHSA-3g2f-4rjg-9385 is a security advisory published by GitHub Security Advisories with Low severity. Weblate leaks information via screenshots

Which CVE IDs does GHSA-3g2f-4rjg-9385 cover?

GHSA-3g2f-4rjg-9385 covers the following CVE IDs: CVE-2026-21889. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3g2f-4rjg-9385?

GHSA-3g2f-4rjg-9385 affects 1 product, including: pip/weblate:\u003c 5.15.2.

GHSA-3g2f-4rjg-9385Low

Weblate leaks information via screenshots

Vendor

GitHub Security Advisories

Published

January 14, 2026

Last Modified

January 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-21889 →

📋 Description

Impact

The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.

Patches

https://github.com/WeblateOrg/weblate/pull/17516

References

Thanks to Lukas May and Michael Leu for reporting this.

🎯 Affected products1

pip/weblate:< 5.15.2

🔗 References (5)

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3g2f-4rjg-9385
https://github.com/WeblateOrg/weblate/pull/17516
https://github.com/WeblateOrg/weblate/commit/a6eb5fd0299780eca286be8ff187dc2d10feec47
https://nvd.nist.gov/vuln/detail/CVE-2026-21889
https://github.com/advisories/GHSA-3g2f-4rjg-9385