CVE-2025-14692 Mayan EDMS authentication redirect
Attackers can exploit an open redirect in Mayan EDMS authentication to potentially bypass security controls or facilitate phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-14692?
CVE-2025-14692 is a medium-severity vulnerability in Mayan EDMS, published on 14 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."
Weakness: CWE-601
Which versions are affected by CVE-2025-14692?
11 open source packages ship an affected version, including mayan-edms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mayan-edms PyPI | All versions | 4.10.2 |
mayan-edms PyPI | All versions | 4.6.12 |
mayan-edms PyPI | All versions | 4.6.12 |
mayan-edms PyPI | From 4.10.0 | 4.10.2 |
mayan-edms PyPI | From 4.10.0 | 4.10.2 |
mayan-edms PyPI | From 4.7.0 | 4.7.8 |
5 more packages
mayan-edms PyPI | From 4.7.0 | 4.7.8 |
mayan-edms PyPI | From 4.8.0 | 4.8.10 |
mayan-edms PyPI | From 4.8.0 | 4.8.10 |
mayan-edms PyPI | From 4.9.0 | 4.9.7 |
mayan-edms PyPI | From 4.9.0 | 4.9.7 |
Products include Mayan-Edms Mayan Edms.
How do I fix CVE-2025-14692?
Upgrade mayan-edms to a fixed version for your release line: 4.10.2, 4.6.12, 4.7.8 or 4.8.10.
Is CVE-2025-14692 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14692 exists.
Other vulnerabilities in Mayan EDMS
Sources
Also known as GHSA-x37w-7p52-8f49, PYSEC-2025-135.