M Files Server

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.

Published: 2026-04-01T10:03:27.785Z
Updated: 2026-04-01T12:38:30.875Z

Denial-of-service vulnerability in M-Files Server versions before 26.1.15632.3 allows an authenticated attacker with vault administrator privileges to crash the M-Files Server process by calling a vulnerable API endpoint.

Published: 2026-01-21T10:29:57.786Z
Updated: 2026-02-23T10:39:26.170Z

Improper isolation of users in M-Files Server version before 25.3.14549 allows anonymous user to affect other anonymous users views and possibly cause a denial of service

Published: 2025-04-04T06:37:42.901Z
Updated: 2026-02-23T10:26:58.607Z

Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7

Published: 2025-12-19T06:15:09.580Z
Updated: 2026-02-23T10:35:14.878Z

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change.

Published: 2025-01-23T11:06:19.319Z
Updated: 2026-02-23T10:24:49.952Z

Denial of service condition in M-Files Server in versions before 25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions.

Published: 2025-01-23T11:07:51.496Z
Updated: 2026-02-23T10:23:57.202Z

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords

Published: 2025-01-23T11:07:10.295Z
Updated: 2026-02-23T10:23:24.587Z

Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources.

Published: 2024-04-26T06:02:21.917Z
Updated: 2026-02-23T10:10:50.553Z

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.

Published: 2023-12-20T09:35:46.232Z
Updated: 2026-02-23T10:07:53.064Z

A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests.

Published: 2023-12-20T09:36:39.118Z
Updated: 2026-02-23T09:00:05.026Z

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

Published: 2023-11-28T14:07:20.877Z
Updated: 2026-02-23T08:58:36.807Z

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

Published: 2023-11-22T09:56:44.563Z
Updated: 2026-02-23T08:56:33.921Z

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

Published: 2023-11-22T09:56:32.749Z
Updated: 2026-02-23T08:55:34.657Z

Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.

Published: 2023-08-25T08:08:05.954Z
Updated: 2026-02-23T08:48:57.088Z

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service

Published: 2023-06-27T14:24:40.316Z
Updated: 2026-02-23T08:46:31.978Z

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.

Published: 2023-04-20T08:05:52.085Z
Updated: 2026-02-23T08:38:53.027Z

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job.

Published: 2023-04-20T08:02:10.554Z
Updated: 2026-02-23T08:37:27.894Z

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.

Published: 2023-04-20T08:00:31.910Z
Updated: 2026-02-23T08:36:12.763Z

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.

Published: 2023-04-05T06:13:59.289Z
Updated: 2026-02-23T08:33:54.415Z

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3.

Published: 2023-03-06T10:46:20.520Z
Updated: 2026-02-23T08:17:22.154Z

Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.

Published: 2022-12-30T11:24:35.870Z
Updated: 2026-02-23T08:12:14.872Z

Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.

Published: 2022-12-02T12:20:58.815Z
Updated: 2026-02-23T08:08:41.201Z

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0.

Published: 2023-03-06T10:39:43.877Z
Updated: 2026-02-23T07:58:28.163Z

Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.

Published: 2022-11-30T14:35:17.470Z
Updated: 2026-02-23T08:19:33.731Z

Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.

Published: 2022-11-30T14:05:15.099Z
Updated: 2026-02-23T07:54:17.860Z

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities.

Published: 2022-01-18T16:51:49.630Z
Updated: 2026-02-23T07:50:32.583Z

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.

Published: 2022-01-18T16:51:52.431Z
Updated: 2026-02-23T07:48:09.932Z

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier.

Published: 2022-01-18T16:51:50.929Z
Updated: 2026-02-23T07:49:22.819Z