What’s Vulnerable › Vulnerabilities

CVE-2025-14692: Mayan EDMS authentication redirect

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-15 · updated 2026-10-07
• Weakness: CWE-601

Description

A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."

Affected products

• Mayan EDMS: before 4.10.2 — fixed in 4.10.2

How to fix

Upgrade to a fixed version: Mayan EDMS 4.10.2. Check the vendor advisory for mitigations.

References

• https://docs.mayan-edms.com/chapters/releases/4.10.2.html
• https://docs.mayan-edms.com/chapters/releases/4.10.2.html#security
• https://github.com/ionutluca888/Mayan-EDMS-OpenRedirect-POC/tree/main
• https://vuldb.com/?ctiid.336410
• https://vuldb.com/?id.336410
• https://vuldb.com/?submit.711729

Get alerted when CVE-2025-14692 or the next vulnerability affects your stack