CVE-2025-64725 Weblate has improper validation upon invitation acceptance
Attackers can accept invitations opened by other users, potentially gaining unauthorized access to projects or accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64725?
CVE-2025-64725 is a low-severity vulnerability in WeblateOrg weblate, published on 15 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended.
Weakness: CWE-286
Which versions are affected by CVE-2025-64725?
3 open source packages ship an affected version, including weblate and Weblate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
weblate PyPI | All versions | 5.15 |
weblate PyPI | All versions | 5.15 |
Weblate PyPI | All versions | 5.15 |
Products include Weblate Weblate.
How do I fix CVE-2025-64725?
Upgrade weblate to 5.15 or later.
Is CVE-2025-64725 being exploited?
There is no known exploitation of CVE-2025-64725 in the wild and no public exploit code.
Other vulnerabilities in WeblateOrg weblate
- CVE-2025-68398 Weblate has git config file overwrite vulnerability that leads to remote code execution
- CVE-2026-34393 Weblate: Privilege escalation in the user API endpoint
- CVE-2026-33435 Weblate: Remote code execution during backup restoration
- CVE-2026-34242 Weblate: Arbitrary File Read via Symlink
- CVE-2025-68279 Weblate has an arbitrary file read via symbolic links
Sources
Also known as GHSA-m6hq-f4w9-qrjj, PYSEC-2026-2042.