M-Files vulnerabilities
We track 21 vulnerabilities in M-Files products across 6 products. 21 are rated high or critical, and none are known to be exploited. The most recent was published on May 18, 2026.
Latest M-Files vulnerabilities
- 7.1 High severity
M-Files Server: Improper Validation of Syntactic Correctness of Input
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to crash
- 7.3 High severity
M-Files Server: Server-Side Request Forgery
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.
- 8.6 High severity
M-Files Server: Exposure of Private Personal Information to an Unauthorized Actor
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
- 7.1 High severity
M-Files Server: Improper Isolation or Compartmentalization
Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service
- 7.5 High severity
M-Files Server: Allocation of Resources Without Limits or Throttling
Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions.
- 9.8 Critical severity
M-Files Server: Incorrect Implementation of Authentication Algorithm
Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration.
- 7.5 High severity
M-Files Server: Inefficient Regular Expression Complexity
Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources.
- 9.8 Critical severity
M-Files Server: Improper Restriction of Excessive Authentication Attempts
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.
- 8.8 High severity
M-Files Server: Improper Preservation of Permissions
Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling
- 7.5 High severity
M-Files Server: Allocation of Resources Without Limits or Throttling
A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.
- 7.3 High severity
Web Companion: Unrestricted Upload of File with Dangerous Type
Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types
- 7.8 High severity
Web Companion: Inclusion of Functionality from Untrusted Control Sphere
Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution
- 7.5 High severity
M-Files Server: Uncaught Exception
Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service
- 7.8 High severity
M-Files Client: Missing Authorization
Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
- 7.5 High severity
M-Files Server: Uncontrolled Resource Consumption
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job.
- 7.6 High severity
M-Files New Web: Improper Neutralization of Input During Web Page Generation
Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3.
- 7.5 High severity
M-Files New Web: Exposure of Sensitive Information to an Unauthorized Actor
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0.
- 7.5 High severity
M-Files Server: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
- 7.5 High severity
Hubshare: Improper Authentication
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
- 7.5 High severity
Hubshare: Improper Authentication
Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access restricted PDF files via a known URL.
- 8.8 High severity
Hubshare: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.