What is CVE-2023-2325?

CVE-2023-2325 is a high-severity vulnerability in M-Files Classic Web, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2023-10-20.

How severe is CVE-2023-2325?

High severity. CVSS v3 base score is 7.3 out of 10.

XSS in M-Files Classic Web

CVE-2023-2325

Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2023-10-20 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.004 (34.5th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

M-Files Classic Web — versions 23.2, 23.8
M-Files Web — versions 0, 23.2 LTS SR4, 23.8 LTS SR1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

product.m-files.com/security-advisories/cve-2023-2325/ (vendor-advisory)
empower.m-files.com/security-advisories/CVE-2023-2325 (vendor-advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2023-2325?: CVE-2023-2325 is a high-severity vulnerability in M-Files Classic Web, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2023-10-20.
How severe is CVE-2023-2325?: High severity. CVSS v3 base score is 7.3 out of 10.