PT-2026-33125 · Weblate · Weblate

Published 2026-04-15 · Updated 2026-05-15 · CVE-2026-40256

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description Repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This process is not path-segment aware and can be bypassed when an external path shares the same string prefix as the repository path, such as when one path is named repo and another is repo outside.

Recommendations Update to version 5.17.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40256

GHSA-FFGH-3JRF-8WVH

Affected Products

Weblate

References · 9

• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh · Vendor Advisory
• https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15 · Patch
• https://osv.dev/vulnerability/GHSA-ffgh-3jrf-8wvh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40256 · Security Note
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/pull/18847 · Note
• https://twitter.com/dailycve/status/2044930694065856689 · Twitter Post
• https://twitter.com/__M9nx/status/2055349720055214088 · Twitter Post
• https://twitter.com/CVEnew/status/2044737932343308463 · Twitter Post