Executive brief
Mayan EDMS, an open-source document management system, is vulnerable to a security flaw that allows attackers to execute malicious scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could potentially steal login session information or perform unauthorized actions on behalf of the user. This issue affects the login and password reset pages and can be exploited without needing an account on the system.
Technical details
A DOM-based cross-site scripting (XSS) vulnerability exists in Mayan EDMS due to insecure handling of 'window.location' within client-side JavaScript templates. Specifically, the application reflects attacker-controlled data from the URL hash into a navigation script without proper sanitization. An unauthenticated remote attacker can exploit this by crafting a URL containing a 'javascript:' URI in the fragment identifier (e.g., /authentication/login/#javascript:alert(1)). When a victim visits the link, the malicious script executes in the context of their session. The vulnerability was addressed by enforcing same-origin and HTTP-only redirection logic in version 4.10.2 and corresponding backports.
Affected products
- Mayan EDMS Mayan EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1
Timeline
- 2025-12-13: patched: Version 4.10.2 released
- 2025-12-14: disclosed: NVD publication and public exploit availability
- 2025-12-15: advisory: GitHub Advisory published