Argument injection in Weblate SSH management console (ssh-add)

This repository is a small standalone exploit PoC for CVE-2026-24126 affecting self-hosted Weblate. It contains two files: a Python exploit script (CVE-2026-24126.py) and a README documenting the vulnerability, affected versions, root cause, usage, and remediation. The exploit is not part of a larger framework. The Python script performs an authenticated web attack against Weblate’s SSH key management feature. It first creates a requests session, fetches /accounts/login/ to obtain a CSRF token, and submits administrator credentials. If login succeeds, it requests the main page to extract another CSRF token, then sends a POST request to /manage/ssh/ with the host parameter set to a crafted value of the form -f<file>. This abuses Weblate’s unsafe passing of the host field to ssh-keyscan, causing ssh-keyscan to interpret the attacker-controlled value as its -f option and read hostnames from an arbitrary local file on the server. The exploit’s main capability is arbitrary file read as the Weblate service account. It does not provide code execution, persistence, or lateral movement. After the POST request, the script parses the returned HTML using BeautifulSoup, locates the alert-danger block, and uses regex patterns to recover leaked file lines from ssh-keyscan error messages such as getaddrinfo, write, and connect failures. The extracted lines are deduplicated and printed to stdout. Repository structure is minimal and purpose-built: one executable Python entry point with login, exploit, and response parsing logic, plus documentation. The code uses requests, argparse, regex, BeautifulSoup, and disables TLS verification warnings. A localhost proxy entry is present for debugging, but it is not actually passed into requests calls. Overall, this is a real operational PoC for authenticated arbitrary file disclosure against vulnerable Weblate instances.