Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

TRUNG BÌNH 5.0CVE-2026-40256 · GHSA-ffgh-3jrf-8wvh · PYSEC-2026-2315 · Công bố 15/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-40256 là lỗ hổng mức TRUNG BÌNH (CVSS 5.0) ảnh hưởng weblate, weblate (weblate).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.32%, cao hơn 25.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.17 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
weblate PyPI	`< 5.17`	`5.17`
weblate weblate	`< 5.17`	`5.17`

Mô tả

Impact

Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside).

Patches

https://github.com/WeblateOrg/weblate/pull/18847

References

Thanks to m9nx4u for reporting this issue via HackerOne.

Mô tả của NVD

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.