CVE-2026-40256: Weblate path traversal via repository boundary check bypass

Executive brief

Weblate, a web-based translation and localization platform, is vulnerable to a security bypass that allows access to files outside of designated project repositories. An attacker with low-level access could potentially view sensitive files on the server that they should not be able to reach. This occurs because the system incorrectly validates file paths when they share similar names, such as 'repo' and 'repo_outside'.

Technical details

A path traversal vulnerability exists in Weblate due to improper repository boundary validation. The application uses a string-based 'startswith' check on resolved absolute paths to ensure file operations remain within the repository root. However, this check is not path-segment aware, allowing a bypass if an attacker-controlled path shares a prefix with the legitimate repository path (e.g., '/data/repo' vs '/data/repo_outside'). An authenticated attacker with network access can exploit this to access files outside the intended directory. The issue is fixed in version 5.17 by implementing more robust path validation.

Affected products

• WeblateOrg weblate < 5.17

Timeline

• 2026-04-15: patched: Fix released in version 5.17
• 2026-04-16: advisory: GitHub Advisory GHSA-ffgh-3jrf-8wvh published

References

• https://api.github.com/users/nijel
• https://github.com/nijel
• https://api.github.com/users/nijel/gists%7B/gist_id%7D
• https://api.github.com/users/nijel/repos
• https://avatars.githubusercontent.com/u/212189?v=4
• https://api.github.com/users/nijel/events%7B/privacy%7D