CVE Intelligence

M-files vulnerabilities

🔔 Create alert RSS

Published CVEs affecting M-files products: 7 record(s), with severity, exploitation and fixes.

M-files Server 7

Exploited only (KEV) →

CVE-2026-0983 High · 7.1 CWE-1286 May 18, 2026
Denial of service vulnerability in M-Files Server
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash
CVE-2026-0932 High · 7.3 CWE-918 Apr 1, 2026
Server-Side Request Forgery (SSRF) in M-files M-files Server
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.
CVE-2026-0663 Medium · 4.9 CWE-1286 Jan 21, 2026
Denial of Service condition in M-Files Server
Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server process by calling a vulnerable API endpoint.
CVE-2025-14267 Medium · 4.9 CWE-212 Dec 19, 2025
Unintended temporary cached data included in a structure only copy intended to be empty of data
Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7
CVE-2025-13008 High · 8.6 CWE-359 Dec 19, 2025
Session Token Disclosure in M-Files Web
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
CVE-2025-14318 Medium · 4.3 CWE-863 Dec 18, 2025
Improper access validation in M-Files Server
Improper access checks in M-Files Server before 25.12.15491.7 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module being enabled.
CVE-2025-11681 Medium · 6.5 CWE-400 Nov 17, 2025
Denial of Service condition in M-Files Server
Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.