CVE-2022-23915 Remote Code Execution (RCE)

What is CVE-2022-23915?

CVE-2022-23915 is a high-severity command injection vulnerability in Weblate, published on 4 Mar 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.

Weakness: CWE-88

Which versions are affected by CVE-2022-23915?

4 open source packages ship an affected version, including Weblate and weblate. It affects 1 product.

Products include Weblate Weblate.

How do I fix CVE-2022-23915?

Upgrade Weblate to 4.11.1 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-23915 being exploited?

There is no known exploitation of CVE-2022-23915 in the wild and no public exploit code.

Other vulnerabilities in Weblate

• CVE-2025-68398 Weblate has git config file overwrite vulnerability that leads to remote code execution Critical 9.1
• CVE-2026-34393 Weblate: Privilege escalation in the user API endpoint High 8.8
• CVE-2026-33435 Weblate: Remote code execution during backup restoration High 8.1
• CVE-2026-34242 Weblate: Arbitrary File Read via Symlink High 7.7
• CVE-2025-68279 Weblate has an arbitrary file read via symbolic links High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as CVE-2022-24727, GHSA-3872-f48p-pxqj, GHSA-h2g5-2rhx-ffgj, SNYK-PYTHON-WEBLATE-2414088.