Vulnerability in M-Files Corporation Server
CVE-2025-13008
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
EPSS: 0.005 (39.9th percentile) — read the EPSS interpretation.
Affected products
- M-files Corporation Server — versions 0, 25.8.15085.18, 25.2.14524.14
Weakness classification (CWE)
References
- security@m-files.com (vendor-advisory)
- security@m-files.com (vendor-advisory)