M Files Security Vulnerabilities (CVEs)

This vulnerability allows authenticated attackers with vault administrator privileges to crash M-Files Server by calling a vulnerable API endpoint, ca...

This vulnerability in M-Files Server allows sensitive information to be exposed due to incomplete data removal before transfer. It affects organizatio...

M-Files Server versions before 25.12.15491.7 have an improper access control vulnerability that allows authenticated users to download files through M...

An authenticated user can cause a denial-of-service by crashing the MFserver process in vulnerable M-Files Server versions. This affects organizations...

A stored cross-site scripting vulnerability in M-Files Hubshare allows authenticated attackers to inject malicious scripts that execute in other users...

An open redirection vulnerability in M-Files mobile applications allows attackers to craft malicious PDF files that trick users into visiting untruste...

CVE-2025-3087 is a stored cross-site scripting (XSS) vulnerability in M-Files Web versions 25.1.14445.5 through 25.2.14524.4. It allows authenticated ...

A configuration change vulnerability in M-Files Server's database driver allows highly privileged attackers to cause unexpected server crashes, leadin...

CVE-2025-0635 is a denial-of-service vulnerability in M-Files Server that allows unauthenticated attackers to consume computing resources, potentially...

This CVE describes a Local File Inclusion vulnerability in M-Files Server that allows authenticated users to read server local files of limited filety...

This stored cross-site scripting (XSS) vulnerability in M-Files Hubshare allows authenticated attackers to inject malicious JavaScript that executes i...

A stored cross-site scripting (XSS) vulnerability in the Social Module of M-Files Hubshare allows authenticated attackers to inject malicious scripts ...

CVE-2024-4056 is a denial-of-service vulnerability in M-Files Server that allows unauthenticated attackers to consume computing resources, potentially...

M-Files Server versions before 23.12.13205.0 lack brute force protection, allowing attackers unlimited authentication attempts to guess user passwords...

This vulnerability allows remote attackers to execute arbitrary code on M-Files Web Companion servers by uploading specially crafted files. It affects...

This is a stored cross-site scripting (XSS) vulnerability in M-Files Classic Web that allows attackers to inject malicious scripts into HTML documents...

This path traversal vulnerability in M-Files Classic Web allows authenticated users to access restricted files on the web server by manipulating file ...

This vulnerability in M-Files Client allows UI extension applications to bypass access permission checks, enabling privilege escalation. Attackers cou...

This vulnerability in M-Files Desktop component service allows an authenticated user in one session to move laterally to another user's session, poten...

This vulnerability in M-Files Server allows attackers to cause denial of service through uncontrolled memory consumption. By sending specially crafted...

This vulnerability allows local attackers to escalate privileges to SYSTEM level on Windows systems by exploiting DLL hijacking in M-Files Installer. ...

This vulnerability allows authenticated users to inject HTML content that gets rendered in other users' browsers in M-Files Web, potentially enabling ...

M-Files Server versions before 22.10.11846.0 can log sensitive authentication tokens to log files when specific configurations are enabled. This vulne...

CVE-2022-4264 is an incorrect privilege assignment vulnerability in M-Files Web (Classic) that allows low-privilege users to modify certain system con...

CVE-2022-1911 is an information disclosure vulnerability in M-Files Server where an error in the parser function allows unauthenticated attackers to a...

This vulnerability allows stored script injection in M-Files Admin versions before 22.2.11051.0. An authenticated vault administrator can store malici...

This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in M-Files Server products. It allows attackers to make unauthorized queries fro...

This vulnerability allows attackers to perform unlimited login attempts against certain M-Files user accounts, enabling brute-force attacks to guess p...

This vulnerability allows denial of service attacks against M-Files Web servers by sending HTTP requests with overlapping Range or Request-Range heade...

This vulnerability in M-Files Web allows remote attackers to access license key information for third-party components without authentication. It affe...