Mayan EDMS
CVE-2025-14692
LOW
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Open redirect requires user click (UI:R) and has no confidentiality/availability impact, only low integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."
AnalysisAI
Open redirect vulnerability in Mayan EDMS allows remote attackers to redirect users to arbitrary websites by crafting malicious URLs targeting the /authentication/ endpoint, affecting versions up to 4.10.1. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed. EPSS indicates a low probability of exploitation at 0.18%.
Technical ContextAI
Mayan EDMS is an open-source document management system. The vulnerability resides in the authentication flow, where improper validation of redirect parameters (CWE-601) in the /authentication/ component allows an attacker-supplied URL to be used as a redirect target. Per the CPE cpe:2.3:a:mayan-edms:mayan_edms:*:*:*:*:*:*:*:*, all versions before the fix are affected. The weakness is an implementation flaw in URL handling logic, which does not sufficiently verify the destination before issuing a redirect response.
RemediationAI
Upgrade to Mayan EDMS version 4.10.2, which contains the vendor-confirmed patch. The vendor states backports for older versions are underway. No alternative workaround is documented; if immediate upgrading is not feasible, limit exposure by restricting network access to the /authentication/ endpoint or implementing a reverse proxy that validates and sanitizes redirect parameters against an allowlist. Note that such controls may interfere with legitimate redirect workflows and should be tested before deployment.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today