Vulnerabilities

TI-2025-11909 CVE-2025-13008 · GHSA-829c-jpvx-vfrv

Session Token Disclosure in M-Files Web

MEDIUM 40

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other a…

CVSS 4.0HIGH 8.6 Network Low privileges User interaction EPSS 0.00481 Published 2025-12-19 Fixed in 25.12.15491.7, 25.8.15085.18 +2 CWE-359

TI-2025-13038 CVE-2025-14267 · GHSA-xcmx-jj38-v524

Unintended temporary cached data included in a structure only copy intended to be empty of data

LOW 25

Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7

CVSS 4.0MEDIUM 5.6 Network High privileges User interaction EPSS 0.00383 Published 2025-12-19 Fixed in 25.12.15491.7 CWE-212

Vulnerabilities

Filters

Session Token Disclosure in M-Files Web

Unintended temporary cached data included in a structure only copy intended to be empty of data