---
id: CVE-2025-50736
aliases:
  - GHSA-pfrv-63w8-q7rq
  - PYSEC-2026-1760
title: Byaidu PDFMathTranslate vulnerable to open redirect
summary: Byaidu PDFMathTranslate vulnerable to open redirect
severity: low
vendor: pdf2zh
product: pdf2zh
ecosystem: pip
affected:
  - pdf2zh
published: '2025-10-30'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-pfrv-63w8-q7rq'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-50736'
  - url: 'https://github.com/Byaidu/PDFMathTranslate'
  - url: 'https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50736'
  - url: 'https://hackmd.io/@fai1424/SJz7ttVWxe'
  - url: 'https://pdf2zh.com'
tags:
  - osv
  - pip
epss: 0.00226
epssPercentile: 0.13224
ingestedAt: '2026-07-08T18:25:51.754Z'
---

## Overview

An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradio_api endpoint. This vulnerability could be exploited for phishing attacks or to bypass security filters.

## Affected packages

- `pdf2zh`

## Remediation

Refer to the advisory for the patched release.