Sensitive information in log files in M-Files Server
Priority LOW 12CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-532.
Summary
In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.
Why it matters now
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed M-Files Server (M-Files): 21.11.10775.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| M-Files Corporation | M-Files Server | Online to before 21.11.10775.0; 2018 to before 21.11.10775.0 | 21.11.10775.0 | Patch available | CNA |
- M-Files Server VendorM-Files Corporation Affected Online to before 21.11.10775.0; 2018 to before 21.11.10775.0 Fixed in 21.11.10775.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:* | before 21.11.10775.0 | Vulnerable | M-Files Corporation |
- cpe:2.3:a:m-files:m-files_server:*:*:*:*:*:*:*:* Versions before 21.11.10775.0 Vulnerable ·M-Files Corporation
Remediation
- Fix · CNA M-Files Server (M-Files) Fixed in 21.11.10775.0
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41808
- 2026-10-03 Alias added: GHSA-h62q-wxxr-4qqj
References
More M-Files Corporation M-files Server vulnerabilities
- TI-2025-05387 Path traversal in M-Files API CVSS 4.0HIGH 8.4
- TI-2024-09388 Support for authentication bypass condition in M-Files LDAP authentication CVSS 4.0CRITICAL 9.2
- TI-2023-06317 Brute force vulnerability in M-Files user authentication CVSS 3.1CRITICAL 9.8
- TI-2021-18438 Missing brute-force protection in M-Files Server CVSS 3.1CRITICAL 9.8
- TI-2024-03776 Regular expression denial of service in M-Files Server CVSS 3.1HIGH 7.5
- TI-2023-03183 Denial of service condition in M-Files Server CVSS 3.1HIGH 7.5
Sources
- CVE-2021-41808 · CVE Program
- CVE-2021-41808 · NVD
- FIRST EPSS
- GHSA-h62q-wxxr-4qqj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences