CVE-2025-49134: Weblate Information Disclosure Vulnerability

CVE-2025-49134 Overview

CVE-2025-49134 is an information disclosure vulnerability in Weblate, a web-based localization tool. Versions prior to 5.12 included the full IP address of the acting user in audit log notification emails. These notification emails traverse third-party infrastructure such as SMTP relays and spam filtering services. As a result, operators of that email infrastructure could observe user IP addresses without authorization. The issue is tracked as CWE-359: Exposure of Private Personal Information to an Unauthorized Actor. Weblate resolved the issue in version 5.12 by anonymizing IP addresses before they appear in outbound notifications.

Critical Impact
User IP addresses transmitted through outbound audit log emails could be harvested by intermediary mail infrastructure, creating a privacy exposure for Weblate users and administrators.

Affected Products

Weblate versions prior to 5.12
Weblate self-hosted deployments using SMTP relays for notifications
Weblate instances routing mail through third-party spam filters

Discovery Timeline

2025-06-16 - CVE-2025-49134 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49134

Vulnerability Analysis

Weblate maintains an audit log that records account-relevant activity such as sign-ins, password changes, and account modifications. When these events occur, Weblate emails a notification to the affected user. Prior to version 5.12, that notification body included the acting user's full IP address in cleartext. Because the messages pass through outbound SMTP servers, relays, and spam scanning services, any intermediary handler could read and retain the IP address. This constitutes an unintended disclosure of personal data to unauthorized third parties as defined by CWE-359.

Root Cause

The root cause is the direct inclusion of user IP addresses in notification email templates without anonymization. The Celery task notify_auditlog in weblate/accounts/tasks.py rendered AuditLog records into email bodies containing the unmodified address field. No masking, truncation, or subnet aggregation was applied before dispatch.

Attack Vector

The vulnerability does not require an active attacker exploiting the Weblate application. Any operator of an SMTP relay, spam filter, or downstream mail handler in the delivery path can passively observe IP addresses embedded in audit notification messages. A malicious insider at a mail service, or an attacker who has compromised such infrastructure, can correlate IPs to user accounts and build a location or activity profile.

python

# Patch excerpt from weblate/accounts/models.py
 import logging
 import re
 from datetime import timedelta
+from ipaddress import IPv6Network, ip_network
 from typing import TYPE_CHECKING, Literal
 from urllib.parse import urlparse

python

# Patch excerpt from weblate/accounts/tasks.py
 @app.task(trail=False)
-def notify_auditlog(log_id, email) -> None:
+def notify_auditlog(log_id: int, email: str) -> None:
     from weblate.accounts.models import AuditLog
     from weblate.accounts.notifications import send_notification_email

Source: Weblate commit 020b2905. The fix introduces ipaddress primitives to anonymize IPv4 and IPv6 addresses before rendering notification content.

Detection Methods for CVE-2025-49134

Indicators of Compromise

Outbound Weblate notification emails whose bodies contain full IPv4 or IPv6 addresses next to audit log events.
Weblate deployments running versions earlier than 5.12 while relaying mail through external SMTP providers.
Third-party mail logs retaining copies of Weblate audit notification messages.

Detection Strategies

Inspect a sample of recent audit log notification emails sent by Weblate and search for IP address patterns in the rendered body.
Query the installed Weblate version and flag any node reporting less than 5.12.
Review outbound mail gateway logs for message archives that may contain the historical IP data.

Monitoring Recommendations

Monitor Weblate release channels and the GitHub Security Advisory GHSA-4qqf-9m5c-w2c5 for follow-up fixes.
Track SMTP relay and spam filter vendor access controls, since these are the parties positioned to observe the disclosed IPs.
Alert on unpatched Weblate hosts through configuration management or vulnerability scanning workflows.

How to Mitigate CVE-2025-49134

Immediate Actions Required

Upgrade Weblate to version 5.12 or later, which anonymizes IP addresses in audit log notifications.
Rotate or purge archived audit notification emails held by SMTP relays and spam filtering vendors where feasible.
Review the trust relationship with any third-party mail processors that handled Weblate notifications.

Patch Information

The fix is delivered in the Weblate 5.12.1 release and merged via Pull Request #15102. The corresponding commit 020b2905 introduces IP anonymization using Python's ipaddress module inside the notify_auditlog task.

Workarounds

Route Weblate mail through a locally controlled SMTP server to remove untrusted intermediaries from the delivery path.
Disable audit log email notifications until the upgrade to 5.12 or later is completed.
Restrict recipient addresses for audit notifications to internal mailboxes served by trusted infrastructure.

bash

# Upgrade example for pip-based Weblate deployments
pip install --upgrade 'Weblate>=5.12.1'
weblate migrate
systemctl restart weblate weblate-celery