VulnSocial

CVE-2026-40256Disclosure(weblate / weblate)

LOWCVSS 5.0 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.

weblate CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • weblate

Threat summary

  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 1 mentions (2026-04-16); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
weblate
Products
weblate

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-04-16: 1Mentions · 2026-04-17: 1Mentions · 2026-05-15: 1Technical Details · 2026-04-16: 1Technical Details · 2026-04-17: 1Technical Details · 2026-05-15: 104-1604-1705-15
Signal classification1 categories
Disclosure
3100.0%
Referenced assets2 URLs
Full discourse3 posts
  • Mounir | مُنِير@__M9nx
    Disclosure

    CVE at Weblate: CVE-2026-40256 , i actually discovered this bug last month but i've been too unmotivated to share or even do anything lately bug was a path traversal caused by unsafe startswith() path validation (repo vs repo_outside) u can reach it at : https://www.cve.org/CVERecord?id=CVE-2026-40256 https://t.co/Pqd0PohFT8

    Post summary

    The post announces a recently discovered path traversal bug in Weblate (CVE‑2026‑40256), providing specific technical details but no proof of exploitation or patch information.

    0001099
    244 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🟠 Weblate, Path Traversal, #CVE-2026-40256 (Medium) https://dailycve.com/weblate-path-traversal-cve-2026-40256-medium/

    Post summary

    The text announces a medium‑severity Path Traversal vulnerability (CVE‑2026‑40256) in Weblate, providing only basic disclosure details.

    0000023
    181 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-40256 Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In mult… https://www.cve.org/CVERecord?id=CVE-2026-40256

    Post summary

    The message provides a brief technical description of a pre‑5.17 validation flaw in Weblate, linking to the CVE record, but does not mention PoC, exploitation, or remediation.

    0000060
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appweblateweblate---

Explore more

Back to dashboardweblate CVEsweblate vulnerabilities