CVE-2025-68398
Published: 18 December 2025
Summary
CVE-2025-68398 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Weblate Weblate. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching to Weblate 5.15.1, which fixes the remote Git configuration overwrite vulnerability.
Addresses the core CWE-20 improper input validation enabling path traversal and dangerous file uploads to overwrite Git configuration.
Restricts access to configuration changes, preventing high-privilege remote overwrites of Git configuration files even for authorized users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-68398 is a critical remote code execution vulnerability in the public-facing web application Weblate, exploitable over the network via path traversal and unrestricted file upload to overwrite Git configuration, directly enabling T1190: Exploit Public-Facing Application.
NVD Description
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
Deeper analysisAI
CVE-2025-68398 affects Weblate, a web-based localization tool, in versions prior to 5.15.1. The vulnerability enables remote overwriting of Git configuration, allowing attackers to override some of Git's behavior. It is associated with CWEs including CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), and CWE-434 (Unrestricted Upload of File with Dangerous Type), and carries a CVSS v3.1 base score of 9.1 (Critical), reflecting network accessibility, low attack complexity, high privileges required, no user interaction, changed scope, and high impacts to confidentiality, integrity, and availability.
An attacker with high privileges (PR:H) can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation allows overwriting Git configuration remotely, potentially overriding Git's behavior to achieve high-impact effects on confidentiality, integrity, and availability across the changed scope, such as unauthorized access, modification, or disruption of localization repositories and related systems.
Mitigation is provided in Weblate version 5.15.1, which fixes the issue. Relevant GitHub references include commits 4837a4154390f7c1d03c0e398aa6439dcfa361b4 and dd8c9d7b00eebe28770fa0e2cd96126791765ea7, pull requests 17330 and 17345, and the release page for Weblate 5.15.1.
Details
- CWE(s)