LogicalBreach Academy

Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on Weblate | Free Bug Bounty Writeup | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

OtherCVSS 6.6Medium

Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on Weblate

hackerone-reports

April 27, 2026

3 views

Save

€0

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3518571 by alexb_616

Describe the security issue you would like to report

Product: Weblate. Verified on self-hosted instances. Affected Versions: Confirmed in version 5.0.2 and the current stable release 5.15.2. Probably all versions are vulnerable.

A critical argument injection vulnerability was discovered in the SSH management interface. The host parameter does not properly sanitize user input before passing it to internal system commands. An attacker with administrative privileges can inject command-line arguments (such as -f) to force the server to read and display the contents of sensitive local files, including /etc/passwd, Django settings.py (containing the SECRET_KEY), and private SSH keys (id_rsa).

Endpoint: /manage/ssh/