CVE-2025-50736 json
Byaidu PDFMathTranslate vulnerable to open redirect
published last yr. modified 4d ago also GHSA-pfrv-63w8-q7rq , PYSEC-2026-1760 , EUVD-2025-37013
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.
Is CVE-2025-50736 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pdf2zh | 1 listed version |
no fix listed |
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
- pdf2zh.com /
-
github.com
/fai1424/Vulnerability-Research/tree/main/CVE-2025-50736
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-50736
advisory
-
github.com
/Byaidu/PDFMathTranslate
package
-
hackmd.io
/@fai1424/SJz7ttVWxe
web
-
pdf2zh.com
web
-
pypi.org
/project/pdf2zh
package
-
github.com
/advisories/GHSA-pfrv-63w8-q7rq
advisory
Sources
- CVE List CVE-2025-50736
- GitHub Advisory GHSA-pfrv-63w8-q7rq
- NVD CVE-2025-50736
- OSV PYSEC-2026-1760
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.