Quick answers
- Is CVE-2026-40256 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40256 being exploited in the wild.
- How severe is CVE-2026-40256?
- Medium severity, with a CVSS score of 5, published 15 April 2026.
- Which products and versions are affected?
- weblate (PyPI) < 5.17, ECOSYSTEM:introduced=0,fixed=5.17.
- Is there a fix for CVE-2026-40256?
- Yes. weblate (PyPI): upgrade to 5.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40256 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-40256?
- Check whether you run weblate (PyPI) or Weblate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- weblate (PyPI): upgrade to 5.17 or later
pip install "weblate>=5.17"
Technical details
A path traversal vulnerability exists in Weblate due to improper repository boundary validation. The application uses a string-based 'startswith' check on resolved absolute paths to ensure file operations remain within the repository root. However, this check is not path-segment aware, allowing a bypass if an attacker-controlled path shares a prefix with the legitimate repository path (e.g., '/data/repo' vs '/data/repo_outside'). An authenticated attacker with network access can exploit this to access files outside the intended directory. The issue is fixed in version 5.17 by implementing more robust path validation.
Affected products
- WeblateOrg weblate < 5.17
Identifiers
- CVE-2026-40256
- GHSA-ffgh-3jrf-8wvh
- PYSEC-2026-2315
Timeline
- 2026-04-15: patched: Fix released in version 5.17
- 2026-04-16: advisory: GitHub Advisory GHSA-ffgh-3jrf-8wvh published