---
id: CVE-2026-40256
aliases:
  - GHSA-ffgh-3jrf-8wvh
  - PYSEC-2026-2315
title: >-
  Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction
  Path Prefix Collision
summary: >-
  Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction
  Path Prefix Collision
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
vendor: weblate
product: weblate
ecosystem: pip
affected:
  - weblate < 5.17
patched:
  - weblate 5.17
published: '2026-04-16'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-ffgh-3jrf-8wvh'
references:
  - url: >-
      https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40256'
  - url: 'https://github.com/WeblateOrg/weblate/pull/18847'
  - url: >-
      https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15
  - url: 'https://github.com/WeblateOrg/weblate'
tags:
  - osv
  - pip
epss: 0.00324
epssPercentile: 0.25726
ingestedAt: '2026-07-13T18:57:57.282Z'
---

## Overview

### Impact
Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside).

### Patches
* https://github.com/WeblateOrg/weblate/pull/18847

### References
Thanks to [m9nx4u](https://hackerone.com/m9nx4u) for reporting this issue via HackerOne.

## Affected packages

- `weblate < 5.17`

## Remediation

Upgrade to a patched release:

- `weblate 5.17`