CVE-2025-7953: PublicCMS Open Redirect Vulnerability

CVE-2025-7953 Overview

CVE-2025-7953 is an open redirect vulnerability in Sanluan PublicCMS versions up to 5.202506.a. The flaw resides in publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html, where the file query parameter is used to redirect iOS user agents without validation. An attacker can craft a URL that appears to point to a trusted PublicCMS host but redirects victims to an attacker-controlled destination. The issue is classified under CWE-601: URL Redirection to Untrusted Site. The vendor has published a patch identified as commit f1af17af004ca9345c6fe4d5936d87d008d26e75.

Critical Impact

Attackers can leverage the trust in the PublicCMS domain to redirect authenticated users to phishing pages or malware delivery infrastructure.

Affected Products

• Sanluan PublicCMS versions up to and including 5.202506.a
• Affected component: publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html
• CPE: cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*

Discovery Timeline

• 2025-07-22 - CVE-2025-7953 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7953

Vulnerability Analysis

The vulnerability exists in the bundled PDF.js viewer shipped with PublicCMS. The viewer.html file contains an inline script that parses the query string and, when the request originates from an iPhone, iPad, or iPod user agent, assigns the untrusted file parameter directly to document.location.href. This creates a client-side open redirect. The exploit requires user interaction, such as clicking a crafted link.

Open redirects on trusted CMS domains are commonly chained with phishing campaigns. Because the redirect originates from a legitimate PublicCMS URL, users and email security gateways may treat the initial link as trustworthy before the browser follows the redirect chain to an attacker destination.

Root Cause

The root cause is missing validation of the file query parameter before it is assigned to document.location.href. The code accepts any value, including absolute URLs pointing to external origins, and performs the navigation without checking that the target is a same-origin PDF resource.

Attack Vector

The attack is remote and initiated over the network. An attacker distributes a URL of the form https://<victim-site>/resource/plugins/pdfjs/viewer.html?file=https://attacker.example/. When an iOS user opens the link, the inline script navigates the browser away from the PublicCMS origin to the attacker-controlled URL.

<!-- Vulnerable code removed by the patch (viewer.html) -->
<script>
var queryParams = new URLSearchParams(document.location.search.substring(1));
if(queryParams.has("file") && navigator.userAgent.match(/iPhone|iPad|iPod/i) ) {
    document.location.href=queryParams.get("file");
}
</script>

Source: PublicCMS commit f1af17a. The patch removes the redirect script entirely, eliminating the sink for the untrusted parameter.

Detection Methods for CVE-2025-7953

Indicators of Compromise

• HTTP requests to /resource/plugins/pdfjs/viewer.html where the file parameter contains an absolute URL pointing to an external domain.
• Referer header chains that begin at a PublicCMS viewer.html URL and terminate at unrelated third-party hosts.
• Increased 3xx or client-side navigation events from iOS user agents targeting the PDF.js viewer path.

Detection Strategies

• Deploy a web application firewall rule that inspects the file query parameter on viewer.html and blocks values containing schemes other than relative paths or same-origin URLs.
• Correlate access logs for viewer.html requests with outbound proxy telemetry to identify users who followed suspicious redirects.
• Search source repositories and web root directories for unpatched copies of the vulnerable PDF.js viewer.html script block.

Monitoring Recommendations

• Monitor web server access logs for anomalous query strings on the PDF.js viewer endpoint.
• Alert on user reports of unexpected navigation after clicking PublicCMS-hosted links.
• Track email gateway telemetry for inbound messages containing links to viewer.html?file= on PublicCMS-hosted domains.

How to Mitigate CVE-2025-7953

Immediate Actions Required

• Apply the upstream patch from commit f1af17af004ca9345c6fe4d5936d87d008d26e75 to remove the vulnerable inline script.
• If patching cannot occur immediately, restrict access to /resource/plugins/pdfjs/viewer.html at the reverse proxy layer.
• Audit any deployed forks or copies of PublicCMS for the same PDF.js viewer code.

Patch Information

The vendor fix is committed to the sanluan/PublicCMS repository as f1af17af004ca9345c6fe4d5936d87d008d26e75. The patch removes the JavaScript block that read queryParams.get("file") and assigned it to document.location.href. Administrators should update to a build that includes this commit and verify the deployed viewer.html no longer contains the redirect script. See the GitHub issue #88 for additional discussion.

Workarounds

• Remove the vulnerable <script> block from publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html and redeploy.
• Add a web server rule that rejects requests to viewer.html when the file parameter starts with http://, https://, or //.
• Enforce a Content Security Policy with a restrictive form-action and navigate-to directive to constrain client-side navigation targets.

# Example nginx rule to block external URLs in the file parameter
location = /resource/plugins/pdfjs/viewer.html {
    if ($arg_file ~* "^(https?:)?//") {
        return 403;
    }
    try_files $uri =404;
}