PT-2026-33125 · Weblateorg · Weblate

Published 2026-04-15 · Updated 2026-04-15 · CVE-2026-40256

Mitre

CVSS v3.1

5.0

Medium

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo outside). This issue has been fixed in version 5.17.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40256

Affected Products

Weblate

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40256 · Security Note
• https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15 · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh · Note