Weblate exposes personal IP address via e-mail

보통 5.3CVE-2025-49134 · GHSA-4qqf-9m5c-w2c5 · PYSEC-2026-2038 · Published 16/06/2025 · updated 17/06/2026

요약

CVE-2025-49134은(는) weblate, weblate (weblate)에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.32%, 전체 취약점의 25.1%보다 높음.
조치: 5.12 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
weblate PyPI	`< 5.12`	`5.12`
weblate weblate	`< 5.12`	`5.12`

Description

Impact

The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.

Patches

This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.

References

Thanks to micael1 for reporting this issue at HackerOne.

NVD description

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.

References

WeblateOrg/weblate security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-49134 · ADVISORY
WeblateOrg/weblate#15102 · WEB
WeblateOrg/weblate commit 020b290 · WEB
WeblateOrg/weblate · PACKAGE
WeblateOrg/weblate release weblate-5.12.1 · WEB
pypi.org/project/weblate · PACKAGE
GitHub Advisory GHSA-4qqf-9m5c-w2c5 · ADVISORY

weblate의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

weblate

PyPI

< 5.12

5.12

weblate

< 5.12

5.12

Description

Impact

The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.

Patches

This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.

References

Thanks to micael1 for reporting this issue at HackerOne.

NVD description

weblate의 다른 취약점

모두 보기 →