sunkaifei FlyCMS CVE-2025-15094

No vendor-released patch identified at time of analysis. The FlyCMS project was informed early via GitHub issue #16 (https://github.com/sunkaifei/FlyCms/issues/16) but has not responded or released a fix. Immediate mitigation requires implementing output encoding for the redirectUrl parameter in UserController.java userLogin method using a Java encoding library such as OWASP Encoder or Apache Commons Text to escape HTML special characters before rendering in HTTP responses or HTML attributes. Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or event handler patterns in the redirectUrl parameter. As a compensating control, restrict the redirectUrl parameter to a whitelist of known safe domains to prevent open redirect combined with XSS. Enforce Content Security Policy (CSP) headers with script-src 'self' to limit inline script execution, which will degrade but not eliminate reflected XSS impact. Monitor for exploitation via access logs containing suspicious characters (%, script, onerror, onload) in the redirectUrl parameter. Consider forking the project or migrating to an actively maintained CMS if security updates are critical for your deployment.