Low severity2.6NVD Advisory· Published Nov 6, 2025· Updated Jun 17, 2026
CVE-2025-64326
CVE-2025-64326
Description
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
weblatePyPI | < 5.14.1 | 5.14.1 |
Affected products
4cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:weblate:weblate:*:*:*:*:*:*:*:*range: <5.14.1
- (no CPE)range: < 5.14.1
- ghsa-coords2 versions
< 5.14.1+ 1 more
- (no CPE)range: < 5.14.1
- (no CPE)range: < 5.14.3-1.1
Patches
Vulnerability mechanics
References
6- github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhcnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-gr35-vpx2-qxhcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-64326ghsaADVISORY
- github.com/WeblateOrg/weblate/commit/b847e9756a0a6f7659ef20fa9f34846ca862c574ghsaWEB
- github.com/WeblateOrg/weblate/pull/16781nvdIssue TrackingWEB
- github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2025-230.yamlghsaWEB
News mentions
0No linked articles in our index yet.