Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

中 5.0CVE-2026-40256 · GHSA-ffgh-3jrf-8wvh · PYSEC-2026-2315 · 15/04/2026 公開 · 26/10/2026 更新

要点

CVE-2026-40256 は weblate, weblate (weblate) に影響する深刻度「中」 (CVSS 5.0) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.32%（全脆弱性の 25.5% より高い）。
対処：5.17 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
weblate PyPI	`< 5.17`	`5.17`
weblate weblate	`< 5.17`	`5.17`

概要

Impact

Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside).

Patches

https://github.com/WeblateOrg/weblate/pull/18847

References

Thanks to m9nx4u for reporting this issue via HackerOne.

NVD の説明

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.