CVE-2026-40256: Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Impact Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repooutside).
Patches https://github.com/WeblateOrg/weblate/pull/18847
References Thanks to m9nx4u for reporting this issue via HackerOne.
Other sources
Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repooutside). This issue has been fixed in version 5.17.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40256?
CVE-2026-40256 has a medium severity level due to its potential for bypassing repository boundary checks.
How do I fix CVE-2026-40256?
To fix CVE-2026-40256, upgrade Weblate to version 5.17 or later.
What types of systems are affected by CVE-2026-40256?
CVE-2026-40256 affects Weblate installations up to version 5.17.
What kind of attack vector does CVE-2026-40256 present?
CVE-2026-40256 presents a path prefix collision vulnerability that can allow unauthorized repository access.
Is CVE-2026-40256 specific to any operating system?
CVE-2026-40256 is not limited to a specific operating system but affects all deployments of the vulnerable Weblate versions.