CVE-2025-14692: Mayan EDMS open redirect in authentication component

CVE-2025-14692 · Severity: medium · CVSS 4.3 · Published 2025-12-15

Mayan EDMS, an open-source document management system, is vulnerable to an open redirect flaw. This security issue allows attackers to create malicious links that appear to be legitimate Mayan EDMS URLs but instead redirect users to external, potentially harmful websites. This can be used in phishing campaigns to steal user credentials or distribute malware by tricking employees into trusting the destination site.

Technologies: mayan-edms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-14692 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-14692 being exploited in the wild.
How severe is CVE-2025-14692?
Medium severity, with a CVSS score of 4.3, published 15 December 2025.
Which products and versions are affected?
Mayan EDMS EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1; mayan-edms (PyPI) ECOSYSTEM:introduced=0,fixed=4.10.2, ECOSYSTEM:introduced=4.10.0,fixed=4.10.2.
Is there a fix for CVE-2025-14692?
Yes. mayan-edms (PyPI): upgrade to 4.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-14692 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-14692?
Check whether you run Mayan EDMS EDMS, Mayan Edms or mayan-edms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mayan-edms (PyPI): upgrade to 4.10.2 or later
    pip install "mayan-edms>=4.10.2"

Technical details

An open redirect vulnerability exists in Mayan EDMS due to insecure handling of the window.location object in client-side JavaScript templates. Specifically, the application improperly processes user-controlled values from the URL hash fragment (#) and the 'next' parameter within the /authentication/ path. An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted link, leading to a redirection to an arbitrary external domain. The root cause is the lack of validation or sanitization of the URL fragment before it is appended to the navigation logic. The vendor has addressed this in version 4.10.2 by enforcing same-origin and HTTP-only redirection.

Affected products

  • Mayan EDMS Mayan EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1

Identifiers

  • CVE-2025-14692
  • GHSA-x37w-7p52-8f49
  • PYSEC-2025-135

Timeline

  • 2025-12-13: patched: Version 4.10.2 released with security hardening for navigation redirects.
  • 2025-12-15: advisory: GitHub Advisory and NVD entry published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.