CVE-2025-49134
Weblate exposes personal IP address via e-mail
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Weblate exposes personal IP address via e-mail
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
- Record
CVE-2025-49134- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-359
- Updated
- 2026-11-02
EUVDEUVD-2025-18399
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
- Record
EUVD-2025-18399- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4qqf-9m5c-w2c5
Weblate exposes personal IP address via e-mail
Impact
The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.
Patches
This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.
References
Thanks to micael1 for reporting this issue at HackerOne.
- Record
GHSA-4qqf-9m5c-w2c5- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
NVD
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
- Record
CVE-2025-49134- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
OSV
Weblate exposes personal IP address via e-mail
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
- Record
CVE-2025-49134- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - Weakness
- CWE-359
- Updated
- 2026-11-02
OSVGHSA-4qqf-9m5c-w2c5
Weblate exposes personal IP address via e-mail
Impact
The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.
Patches
This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.
References
Thanks to micael1 for reporting this issue at HackerOne.
- Record
GHSA-4qqf-9m5c-w2c5- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-359
- Updated
- 2026-11-02
OSVPYSEC-2026-2038
Weblate exposes personal IP address via e-mail
Impact
The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.
Patches
This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.
References
Thanks to micael1 for reporting this issue at HackerOne.
- Record
PYSEC-2026-2038- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
weblatePyPI |
before 5.12 | 5.12 |
weblatePyPI |
before 5.12, plus listed versions 1.92.02.12.102.10.1 Show 45 moreShow less2.112.122.132.13.12.142.14.12.152.162.172.17.12.182.192.19.12.22.202.32.42.52.62.72.82.93.03.0.13.13.1.13.103.10.13.10.23.10.33.113.11.13.11.23.11.33.23.2.13.2.23.33.43.53.5.13.63.6.13.73.7.1 |
5.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49134 is a low vulnerability (CVSS 2.1) in Weblate, published June 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in weblate 5.12.
References
github.com/WeblateOrg/weblate/security/advisories/GHSA-4qqf-9m5c-w2c5
nvd.nist.gov/vuln/detail/CVE-2025-49134
pypi.org/project/weblate
Left out here: 97 versions. The JSON record has them.