2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49134

CVE-2025-49134: Weblate exposes personal IP address via e-mail

Impact

The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.

Patches

This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.

References

Thanks to micael1 for reporting this issue at HackerOne.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49134

CVE-2025-49134:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
weblate	pip	< 5.12	5.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability involves the exposure of users' full IP addresses in audit log notification emails. The provided commit 020b2905e4d001cff2452574d10e6cf3621b5f62 addresses this issue by anonymizing the IP address before it's included in the email.

The core of the vulnerability lies in how the IP address was handled when generating these notification emails.

The weblate/accounts/models.py file shows that the AuditLog model stored the user's IP address in the address attribute. The patch introduces a new property shortened_address to this model, which computes an anonymized version of the IP address.
The most critical change is in weblate/accounts/tasks.py, within the notify_auditlog function. This function is responsible for preparing and sending the audit log notification email.
- Before the patch (vulnerable state): The function would fetch an AuditLog instance (named audit) and directly use audit.address (the full IP address) when constructing the context dictionary for the email template: "address": audit.address,.
- After the patch (fixed state): The function was modified to use the new anonymized IP: "address": audit.shortened_address,.

Therefore, the weblate.accounts.tasks.notify_auditlog function, in its pre-patch version, is the vulnerable function. It directly accessed the full IP address and passed it into the email generation process, leading to the information disclosure. During exploitation (which in this case is simply a user action triggering an audit log notification), this function would be on the call stack as it processes the audit event and prepares the email content containing the sensitive IP address.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

2.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-49134: Weblate exposes personal IP address via e-mail

Impact

Patches

References

CVE-2025-49134:

2.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

2.1

2.1

Basic Information

Basic Information

CVE-2025-49134: Weblate exposes personal IP address via e-mail

Impact

Patches

References

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI