CVE-2025-14691 Mayan EDMS authentication cross site scripting
Remote attackers can execute arbitrary scripts in Mayan EDMS via cross-site scripting in the authentication module, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-14691?
CVE-2025-14691 is a medium-severity cross-site scripting vulnerability in Mayan EDMS, published on 14 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."
Which versions are affected by CVE-2025-14691?
11 open source packages ship an affected version, including mayan-edms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mayan-edms PyPI | All versions | 4.10.2 |
mayan-edms PyPI | All versions | 4.6.12 |
mayan-edms PyPI | All versions | 4.6.12 |
mayan-edms PyPI | From 4.10.0 | 4.10.2 |
mayan-edms PyPI | From 4.10.0 | 4.10.2 |
mayan-edms PyPI | From 4.7.0 | 4.7.8 |
5 more packages
mayan-edms PyPI | From 4.7.0 | 4.7.8 |
mayan-edms PyPI | From 4.8.0 | 4.8.10 |
mayan-edms PyPI | From 4.8.0 | 4.8.10 |
mayan-edms PyPI | From 4.9.0 | 4.9.7 |
mayan-edms PyPI | From 4.9.0 | 4.9.7 |
Products include Mayan-Edms Mayan Edms.
How do I fix CVE-2025-14691?
Upgrade mayan-edms to a fixed version for your release line: 4.10.2, 4.6.12, 4.7.8 or 4.8.10.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-14691 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14691 exists.
Other vulnerabilities in Mayan EDMS
Sources
Also known as GHSA-774q-r975-vqwp, PYSEC-2025-134.