XSS in M-Files Corporation Web

CVE-2026-18372

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.

Vulnerability class: XSS (Cross-Site Scripting)

Affected products

Weakness classification (CWE)

References