weblateorg/weblate · Security
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
- GHSA ID
- GHSA-ffgh-3jrf-8wvh
- CVE ID
- CVE-2026-40256
- Severity
- medium
- Published
- Updated
- CVSS
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- CVSS v3
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Description
Impact
Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside).
Patches
References
Thanks to m9nx4u for reporting this issue via HackerOne.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-40256 ↗
- https://github.com/WeblateOrg/weblate/pull/18847 ↗
- https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15 ↗
- https://github.com/advisories/GHSA-ffgh-3jrf-8wvh ↗