MOLGENIS EMX2 CVE-2025-10355

Exploitation requires the victim to click an attacker-crafted link pointing at a legitimate MOLGENIS EMX2 v11.14.0 instance, where a redirection parameter accepts an externally-controlled destination encoded as '/%2f%2f<MALICIOUS_DOMAIN>' (double-encoded slash bypass). No authentication is needed to craft the link (PR:N), but successful exploitation is gated entirely on social engineering - the user must be induced to click, and there is no impact on the EMX2 application itself, only on the phishing destination the victim is sent to. There is no automated/default-config server compromise path.

This is a genuinely low-priority issue despite a moderate 5.1 CVSS 4.0 score. The vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, unauthenticated open redirect, but it requires active user interaction (UI:A - the victim must click an attacker-crafted link) and produces NO direct impact on the EMX2 system itself (VC:N/VI:N/VA:N). The only scored impact is on subsequent/downstream systems (SC:L/SI:L) - i.e., the harm lands on whatever phishing or malicious site the user is redirected to, not on MOLGENIS. EPSS is low at 0.30% (21st percentile), there is no CISA KEV listing, and no public exploit code was identified, so exploitation is neither confirmed nor imminent. Open redirects are trivially simple to weaponize technically, but their value is purely as a phishing/social-engineering enabler rather than a standalone compromise, which keeps real-world priority low. No signals conflict here: the CVSS, EPSS, and absence of KEV/POC all point consistently to a low-urgency, low-severity finding.

An attacker crafts a URL on the trusted MOLGENIS EMX2 host that abuses the redirection parameter with a payload like '/%2f%2f<attacker-domain>', and delivers it via email or chat. A user who trusts the EMX2 domain clicks the link and is silently redirected to a phishing page harvesting credentials. No public exploit code was identified, though the technique is trivial to reproduce manually.