CVE-2025-14691 — mayan-edms
MEDIUMCVE-2025-14691 is a medium-severity (CVSS 4.3) Cross-site Scripting (XSS) vulnerability in mayan-edms. A fix is available for mayan-edms — see the affected versions and patch details below.
Mayan EDMS is vulnerable to XSS through the /authentication/ file
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-14691.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
mayan-edms🐍mayan-edms🐍mayan-edms🐍mayan-edms🐍mayan-edmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. Users should upgrade the affected component. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | mayan-edms | ≥ 4.10.0&&< 4.10.2 | 4.10.2pip install --upgrade 'mayan-edms==4.10.2' |
| 🐍PyPI | mayan-edms | ≥ 4.9.0&&< 4.9.7 | 4.9.7pip install --upgrade 'mayan-edms==4.9.7' |
| 🐍PyPI | mayan-edms | ≥ 4.8.0&&< 4.8.10 | 4.8.10pip install --upgrade 'mayan-edms==4.8.10' |
| 🐍PyPI | mayan-edms | ≥ 4.7.0&&< 4.7.8 | 4.7.8pip install --upgrade 'mayan-edms==4.7.8' |
| 🐍PyPI | mayan-edms | all versions | 4.6.12pip install --upgrade 'mayan-edms==4.6.12' |
Affected Products
mayan edmsmayan-edmsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mayan-edms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update mayan-edms to 4.10.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-14691 is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is CVE-2025-14691 in your dependencies?
Find it across PyPI, including transitive dependencies.