PyPI/weblate CVE-2026-40256: medium 5, EPSS 0.32%

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses st

Action: Upgrade weblate to 5.17 or later.

pip install weblate==5.17

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2315
• https://github.com/WeblateOrg/weblate/commit/e30dbcb33ae78e754ecef192d54f996b89cb4e15
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-ffgh-3jrf-8wvh

CVE-2026-40256 · published 2026-04-15T19:16:37.470Z · modified 2026-07-13T07:15:47.898340733Z · JSON