Cross-site scripting in M-Files Web
Priority LOW 33CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00509 43rd percentileScored 2026-11-07
Fix Fixed M-Files Web (M-Files): 23.10, 23.2 LTS SR4, 23.8 LTS SR1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| M-Files Corporation | M-Files Web | before 23.10 | 23.10, 23.2 LTS SR4, 23.8 LTS SR1 | Patch available | CNA |
- M-Files Web VendorM-Files Corporation Affected before 23.10 Fixed in 23.10, 23.2 LTS SR4, 23.8 LTS SR1 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:m-files:classic_web:*:*:*:*:-:*:*:* | before 23.10 | Vulnerable | M-Files Corporation |
| cpe:2.3:a:m-files:classic_web:23.2:-:*:*:lts:*:*:* | 23.2 | Vulnerable | M-Files Corporation |
| cpe:2.3:a:m-files:classic_web:23.8:-:*:*:lts:*:*:* | 23.8 | Vulnerable | M-Files Corporation |
- cpe:2.3:a:m-files:classic_web:*:*:*:*:-:*:*:* Versions before 23.10 Vulnerable ·M-Files Corporation
- cpe:2.3:a:m-files:classic_web:23.2:-:*:*:lts:*:*:* Versions 23.2 Vulnerable ·M-Files Corporation
- cpe:2.3:a:m-files:classic_web:23.8:-:*:*:lts:*:*:* Versions 23.8 Vulnerable ·M-Files Corporation
Remediation
- Fix · CNA M-Files Web (M-Files) Fixed in 23.10, 23.2 LTS SR4, 23.8 LTS SR1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2325
- 2026-10-03 Alias added: GHSA-566r-vx98-9rr7
References
More M-Files Corporation Classic Web vulnerabilities
- TI-2023-03201 CVE-2023-3425: Out-of-Bounds memory read CVSS 3.1MEDIUM 6.5
- TI-2023-03184 Path traversal issue in M-Files Classic Web CVSS 3.1HIGH 7.7
Sources
- CVE-2023-2325 · CVE Program
- CVE-2023-2325 · NVD
- FIRST EPSS
- GHSA-566r-vx98-9rr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences