tolgee — Vulnerabilities & Security Advisories 6

Tolgee is a cloud-based localization platform enabling developers to manage translations across applications. Historically, vulnerabilities have included stored cross-site scripting (XSS) due to improper input sanitization in translation fields, remote code execution (RCE) via unsafe deserialization in API endpoints, and privilege escalation through broken access controls in administrative functions. Security assessments reveal consistent issues with insufficient output encoding and inadequate authentication mechanisms. While no major public incidents have been widely documented, the six CVEs indicate recurring patterns of web application vulnerabilities, particularly in how user-generated content is processed and how privilege boundaries are enforced within the platform's translation management workflow.