What’s Vulnerable › Vulnerabilities

CVE-2026-40256: Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-15 · updated 2026-10-26
• Weakness: CWE-22

Description

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.

Affected products

• WeblateOrg weblate: before 5.17 — fixed in 5.17

How to fix

Upgrade to a fixed version: WeblateOrg weblate 5.17. Check the vendor advisory for mitigations.

References

• https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh

Get alerted when CVE-2026-40256 or the next vulnerability affects your stack