PYSEC-2026-1760

    Dashboard / Vulnerabilities / PYSEC-2026-1760

    PYSEC-2026-1760

    Published: 7 Jul 2026Last Modified: 7 Jul 2026

    Summary: Byaidu PDFMathTranslate vulnerable to open redirect

    Details: An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.

    References: https://nvd.nist.gov/vuln/detail/CVE-2025-50736, https://github.com/Byaidu/PDFMathTranslate, https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50736, https://hackmd.io/@fai1424/SJz7ttVWxe, https://pdf2zh.com, https://pypi.org/project/pdf2zh, https://github.com/advisories/GHSA-pfrv-63w8-q7rq

    Affected packages

    Package

    Name: pdf2zh

    Purl: pkg:pypi/pdf2zh

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.9.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2026-1760 | CVE-DB