Weblate before version 5.17 performs repository-boundary validation by checking if resolved absolute paths start with the repository root path using a simple string prefix check. This method is not path-segment aware, meaning that an attacker can bypass the check if an external path shares the same string prefix as the repository path (e.g., 'repo' and 'repo_outside'). This improper limitation of pathname to a restricted directory (CWE-22) can lead to unauthorized access to files outside the intended repository boundaries. The vulnerability was addressed and fixed in version 5.17.

An attacker with at least low privileges (PR:L) can exploit this vulnerability remotely (AV:N) without user interaction (UI:N) to gain read access to files outside the intended repository directory. The impact is limited to confidentiality (C:L) with no integrity or availability impact. The vulnerability can lead to exposure of sensitive information stored outside the repository root.

Upgrade Weblate to version 5.17 or later, where this path traversal vulnerability has been fixed. Since the vendor advisory confirms the fix in version 5.17, applying this official update is the recommended remediation. Patch status is confirmed by the vendor's versioning information.