Description
LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| LibreTranslate | LibreTranslate | ≤ 1.9.6 | — |
References
- GitHub Issue #1012 issue-tracking
- https://github.com/LibreTranslate/LibreTranslate product
- the download route is declared without the access_check decorator technical-description
- VulnCheck Advisory: LibreTranslate through 1.9.6 Missing Access Check on the download_file Route third-party-advisory