Open redirect via unsanitized redir.php URL

Open redirect in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites through a crafted redir.php URL. The redir.php handler accepts an attacker-supplied destination directly from the request query and returns it in the Location header without restricting the target. No authentication is required, but a victim must follow the crafted link; successful exploitation sends the browser to an attacker-chosen site.