Is CVE-2025-14691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14691 being exploited in the wild.

How severe is CVE-2025-14691?

Medium severity, with a CVSS score of 4.3, published 14 December 2025.

Which products and versions are affected?

Mayan EDMS EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1; mayan-edms (PyPI) ECOSYSTEM:introduced=0,fixed=4.10.2, ECOSYSTEM:introduced=4.10.0,fixed=4.10.2.

Is there a fix for CVE-2025-14691?

Yes. mayan-edms (PyPI): upgrade to 4.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-14691 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-14691?

Check whether you run Mayan EDMS EDMS, Mayan Edms or mayan-edms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14691: Mayan EDMS DOM-based XSS in authentication component

Q: Which products and versions are affected?

Mayan EDMS EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1; mayan-edms (PyPI) ECOSYSTEM:introduced=0,fixed=4.10.2, ECOSYSTEM:introduced=4.10.0,fixed=4.10.2.

Q: Is there a fix for CVE-2025-14691?

Yes. mayan-edms (PyPI): upgrade to 4.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-14691 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-14691?

Check whether you run Mayan EDMS EDMS, Mayan Edms or mayan-edms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14691 · Severity: medium · CVSS 4.3 · Published 2025-12-14

Mayan EDMS, an open-source document management system, is vulnerable to a security flaw that allows attackers to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could potentially steal login session information or perform unauthorized actions on behalf of the user. This issue affects the login and password reset pages and can be exploited without needing an account on the system.

Technologies: mayan-edms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-14691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14691 being exploited in the wild.
How severe is CVE-2025-14691?: Medium severity, with a CVSS score of 4.3, published 14 December 2025.
Which products and versions are affected?: Mayan EDMS EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1; mayan-edms (PyPI) ECOSYSTEM:introduced=0,fixed=4.10.2, ECOSYSTEM:introduced=4.10.0,fixed=4.10.2.
Is there a fix for CVE-2025-14691?: Yes. mayan-edms (PyPI): upgrade to 4.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14691 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-14691?: Check whether you run Mayan EDMS EDMS, Mayan Edms or mayan-edms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mayan-edms (PyPI): upgrade to 4.10.2 or later
```
pip install "mayan-edms>=4.10.2"
```

Technical details

A DOM-based cross-site scripting (XSS) vulnerability exists in Mayan EDMS due to insecure handling of 'window.location' within client-side JavaScript templates. Specifically, the application reflects attacker-controlled data from the URL hash into a navigation script without proper sanitization. An unauthenticated remote attacker can exploit this by crafting a URL containing a 'javascript:' URI in the fragment identifier (e.g., /authentication/login/#javascript:alert(1)). When a victim visits the link, the malicious script executes in the context of their session. The vulnerability was addressed by enforcing same-origin and HTTP-only redirection logic in version 4.10.2 and corresponding backports.

Affected products

Mayan EDMS Mayan EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1

Identifiers

CVE-2025-14691
GHSA-774q-r975-vqwp
PYSEC-2025-134

Timeline

2025-12-13: patched: Version 4.10.2 released
2025-12-14: disclosed: NVD publication and public exploit availability
2025-12-15: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.