CVE-2025-50736
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
Oct 30, 2025
CISA due date
—
The record
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pdf2zh | 1.9.9 | No fix |
| pypi | pdf2zh | 1.9.9 | No fix |
Related vulnerabilities
- GHSA-pfrv-63w8-q7rq Byaidu PDFMathTranslate vulnerable to open redirect Same vulnerability
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
- CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601
- CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. CWE-601
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-601
- CVE-2026-8323 URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information… CWE-601
- CVE-2026-78377 URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics… CWE-601
- CVE-2026-81741 The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2… CWE-601