CSS injection in M-Files Web
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 36th percentileScored 2026-11-07
Fix Fixed M-Files Web (M-Files Corporation): 26.8.16330.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| M-Files Corporation | M-Files Web | before 26.8.16330.2 | 26.8.16330.2 | Patch available | CNA |
- M-Files Web VendorM-Files Corporation Affected before 26.8.16330.2 Fixed in 26.8.16330.2 Patch available CNA
Remediation
- Fix · CNA M-Files Web (M-Files Corporation) Fixed in 26.8.16330.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
M-Files Web 26.8.16330.2
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-15106 HTML injection in M-Files WebPriority LOW 23
Timeline
- 2026-10-02 Threatist record created from CVE-2026-18372
- 2026-10-03 Alias added: GHSA-2qm2-pcpp-5p89
References
More M-Files Corporation vulnerabilities
- TI-2021-15287 M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in… CVSS 3.1HIGH 7.5
- TI-2025-05387 Path traversal in M-Files API CVSS 4.0HIGH 8.4
- TI-2024-09388 Support for authentication bypass condition in M-Files LDAP authentication CVSS 4.0CRITICAL 9.2
- TI-2023-06317 Brute force vulnerability in M-Files user authentication CVSS 3.1CRITICAL 9.8
- TI-2021-18438 Missing brute-force protection in M-Files Server CVSS 3.1CRITICAL 9.8
- TI-2025-11909 Session Token Disclosure in M-Files Web CVSS 4.0HIGH 8.6
Sources
- CVE-2026-18372 · CVE Program
- CVE-2026-18372 · NVD
- FIRST EPSS
- GHSA-2qm2-pcpp-5p89 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences