# CVE-2025-14692: Mayan EDMS open redirect in authentication component

Source: https://junglewise.ai/threats/cve-2025-14692-mayan-edms-open-redirect-in-authentication-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-15. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2025-14692 · Severity: medium · CVSS 4.3 · Published 2025-12-15

Mayan EDMS, an open-source document management system, is vulnerable to an open redirect flaw. This security issue allows attackers to create malicious links that appear to be legitimate Mayan EDMS URLs but instead redirect users to external, potentially harmful websites. This can be used in phishing campaigns to steal user credentials or distribute malware by tricking employees into trusting the destination site.

Technologies: [mayan-edms (PyPI)](https://junglewise.ai/threats/technologies/mayan-edms). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-14692 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-14692 being exploited in the wild.

**How severe is CVE-2025-14692?** Medium severity, with a CVSS score of 4.3, published 15 December 2025.

**Which products and versions are affected?** Mayan EDMS EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1; mayan-edms (PyPI) ECOSYSTEM:introduced=0,fixed=4.10.2, ECOSYSTEM:introduced=4.10.0,fixed=4.10.2.

**Is there a fix for CVE-2025-14692?** Yes. mayan-edms (PyPI): upgrade to 4.10.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-14692 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-14692?** Check whether you run Mayan EDMS EDMS, Mayan Edms or mayan-edms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mayan-edms (PyPI): upgrade to 4.10.2 or later

  ```sh
  pip install "mayan-edms>=4.10.2"
  ```


## Technical details

An open redirect vulnerability exists in Mayan EDMS due to insecure handling of the window.location object in client-side JavaScript templates. Specifically, the application improperly processes user-controlled values from the URL hash fragment (#) and the 'next' parameter within the /authentication/ path. An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted link, leading to a redirection to an arbitrary external domain. The root cause is the lack of validation or sanitization of the URL fragment before it is appended to the navigation logic. The vendor has addressed this in version 4.10.2 by enforcing same-origin and HTTP-only redirection.

## Affected products

- Mayan EDMS Mayan EDMS < 4.6.12, 4.7.0 - 4.7.7, 4.8.0 - 4.8.9, 4.9.0 - 4.9.6, 4.10.0 - 4.10.1

## Identifiers

- CVE-2025-14692
- GHSA-x37w-7p52-8f49
- PYSEC-2025-135

## Timeline

- 2025-12-13: patched: Version 4.10.2 released with security hardening for navigation redirects.
- 2025-12-15: advisory: GitHub Advisory and NVD entry published.

## References

- [https://docs.mayan-edms.com/chapters/releases/4.10.2.html](https://docs.mayan-edms.com/chapters/releases/4.10.2.html)
- [https://github.com/ionutluca888/Mayan-EDMS-OpenRedirect-POC/tree/main](https://github.com/ionutluca888/Mayan-EDMS-OpenRedirect-POC/tree/main)
- [https://vuldb.com/?ctiid.336410](https://vuldb.com/?ctiid.336410)
- [https://vuldb.com/?id.336410](https://vuldb.com/?id.336410)
- [https://vuldb.com/?submit.711729](https://vuldb.com/?submit.711729)

## Related threats

- [Mayan EDMS DOM-based XSS in authentication component](https://junglewise.ai/threats/cve-2025-14691-mayan-edms-dom-based-xss-in-authentication-component)
- [PYSEC-2023-276 - An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.](https://junglewise.ai/threats/cve-2022-47419-mayan-edms-dms-xss-vulnerability)
- [PYSEC-2018-16 - An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.](https://junglewise.ai/threats/cve-2018-16405-mayan-edms-cross-site-scripting-vulnerability)
- [PYSEC-2018-15 - An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.](https://junglewise.ai/threats/cve-2018-16407-moderate-severity-vulnerability-that-affects-mayan-edms)
- [PYSEC-2018-14 - An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.](https://junglewise.ai/threats/cve-2018-16406-moderate-severity-vulnerability-that-affects-mayan-edms)