According to the GNU license list, CC BY-SA 4.0 is one way compatible with GPLv3. You may license your modified versions of CC BY-SA 4.0 material under GPLv3, but you may not relicense GPLv3 works under CC BY-SA. Mixing the two in a repository needs a clear direction of flow.
What the GNU page says
The license list describes CC BY-SA as a copyleft license suited to artistic and educational works. For version 4.0 it states that you may license your modified versions of those materials under GPL version 3, but you may not relicense GPL 3 works under CC BY-SA.
It also notes a version detail. Creative Commons lists only version 3 of the GPL on its compatible licenses page. So you cannot license adapted CC BY-SA works under the terms of GPL version 3 or later at your option, only under version 3.
Where this shows up
- Documentation and diagrams copied from a CC BY-SA source into a GPL project.
- Sample data, icons or images with CC BY-SA terms bundled in a release.
- Text and code taken from a site that publishes under CC BY-SA. The terms of the source site, not the repository, decide your obligations. Check the license shown for the specific content, since terms can differ by date.
Practical rules
- Know the direction. Adapted CC BY-SA 4.0 material can be folded into GPLv3 work. Your GPLv3 code cannot be republished as CC BY-SA.
- Keep attribution. CC BY-SA requires credit, so keep the author and license notice with the material.
- Mark the files. A header or an adjacent license file stating the origin avoids confusion later.
- Avoid the or-later wording for those adapted pieces. Name GPL-3.0-only for them.
- Keep software and content separate where you can. A docs folder with its own license file is easier to audit than a mix.
Software use of CC licenses
Creative Commons licenses were designed for content, not code. A repo that uses one for source code is a flag for review. A related earlier post covers Creative Commons licenses for software code.
Audit angle
License scanners can miss content licenses in documentation or assets because they focus on package manifests. Add a manual look at the asset folders before a release or an acquisition review.
Safeguard's SBOM and dependency scanning cover packages, not licensed content in a docs folder, so this check stays manual. A free scan covers the dependency side.
Quick check
Can I put adapted CC BY-SA 4.0 text under GPLv3?
Yes, per the GNU license list. The reverse is not allowed.
Can I choose GPL version 3 or later for adapted CC BY-SA text?
The GNU page says no, because Creative Commons lists only version 3 of the GPL as compatible.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
