Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Description

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.

Scores

EPSS (exploitation in 30 days)

0.32% · top 74% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

• WeblateOrg · weblate

  • affected < 5.17

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• PyPIweblateGHSA-ffgh-3jrf-8wvh (opens in a new tab)

References (2)

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh (opens in a new tab)x_refsource_CONFIRM
• https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-ffgh-3jrf-8wvh (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-40256](https://trackcve.app/badge/CVE-2026-40256.svg)](https://trackcve.app/cve/CVE-2026-40256)

Record last updated 16 Apr 2026, 14:11 UTC.