CVE-2025-49134 Weblate exposes personal IP address via e-mail
Weblate exposed users' full IP addresses in audit log notifications, allowing third-party servers to obtain this personal information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49134?
CVE-2025-49134 is a low-severity vulnerability in WeblateOrg weblate, published on 16 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
Weakness: CWE-359
Which versions are affected by CVE-2025-49134?
3 open source packages ship an affected version, including weblate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
weblate PyPI | All versions | 5.12 |
weblate PyPI | All versions | 5.12 |
weblate PyPI | All versions | 5.12 |
Products include Weblate Weblate.
How do I fix CVE-2025-49134?
Upgrade weblate to 5.12 or later.
Is CVE-2025-49134 being exploited?
There is no known exploitation of CVE-2025-49134 in the wild and no public exploit code.
Other vulnerabilities in WeblateOrg weblate
- CVE-2025-68398 Weblate has git config file overwrite vulnerability that leads to remote code execution
- CVE-2026-34393 Weblate: Privilege escalation in the user API endpoint
- CVE-2026-33435 Weblate: Remote code execution during backup restoration
- CVE-2026-34242 Weblate: Arbitrary File Read via Symlink
- CVE-2025-68279 Weblate has an arbitrary file read via symbolic links
Sources
Also known as GHSA-4qqf-9m5c-w2c5, PYSEC-2026-2038.