CVE-2025-50736

An open redirect vulnerability exists in PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites. This vulnerability could be exploited for phishing attacks or to bypass security filters.

When a URL is provided to the /gradio_api/file= endpoint, the application fails to properly validate the input and responds with an HTTP 302 redirect to the specified location. The application does not restrict the redirect targets, allowing redirection to arbitrary external domains.

A request to /gradio_api/file=http://example.com results in a 302 redirect response:
after following