CVE-2026-40256: Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

April 16, 2026

Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside).

References

github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15
github.com/WeblateOrg/weblate/pull/18847
github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh
github.com/advisories/GHSA-ffgh-3jrf-8wvh
nvd.nist.gov/vuln/detail/CVE-2026-40256

Code Behaviors & Features

Detect and mitigate CVE-2026-40256 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →