CVE-2025-2091
📋 TL;DR
An open redirection vulnerability in M-Files mobile applications allows attackers to craft malicious PDF files that trick users into visiting untrusted URLs. This affects Android and iOS users of M-Files mobile apps before version 25.6.0. Attackers can exploit this to redirect users to phishing sites or malicious content.
💻 Affected Systems
- M-Files Mobile for Android
- M-Files Mobile for iOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to sophisticated phishing sites that steal credentials or deliver malware, potentially leading to account compromise or system infection.
Likely Case
Users redirected to phishing pages attempting to steal login credentials or personal information through social engineering.
If Mitigated
Users might see unexpected redirects but modern browsers may warn about suspicious sites, reducing successful phishing.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious PDF), but the technical complexity is low once the PDF is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.6.0
Vendor Advisory: https://product.m-files.com/security-advisories/cve-2025-2091
Restart Required: Yes
Instructions:
1. Open Google Play Store (Android) or App Store (iOS). 2. Search for 'M-Files Mobile'. 3. Update to version 25.6.0 or later. 4. Restart the application after update.
🔧 Temporary Workarounds
Disable PDF preview in M-Files
allConfigure M-Files server to disable PDF preview functionality in mobile apps
User awareness training
allEducate users to avoid opening PDF files from untrusted sources in M-Files mobile app
🧯 If You Can't Patch
- Implement network filtering to block known malicious domains and phishing sites
- Deploy endpoint protection that can detect malicious PDF files
🔍 How to Verify
Check if Vulnerable:
Check M-Files Mobile app version in app settings. If version is below 25.6.0, the system is vulnerable.Check Version:
Open M-Files Mobile app → Settings → About → Check version numberVerify Fix Applied:
Confirm M-Files Mobile app version is 25.6.0 or higher in app settings.📡 Detection & Monitoring
Log Indicators:
- Unexpected redirects from M-Files mobile app to external domains
- Multiple failed authentication attempts following PDF file access
Network Indicators:
- HTTP/HTTPS requests from M-Files mobile apps to unusual or newly registered domains
- Traffic patterns showing mobile app users accessing non-M-Files domains
SIEM Query:
source="mfiles-mobile" AND (url_contains="http://" OR url_contains="https://") AND NOT url_contains="m-files.com"