M-Files M-Files Server

Name: M-Files M-Files Server
Brand: M-Files

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical9high15medium1low

updated 2026-10-28

vulnerabilities (31)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-5964US	medium6.5	13.0% (96th)	Exploit	25.6.14925.0	2025-06-15	< 25.6.14925.0
CVE-2021-41807US	critical9.8	1.11% (66th)	—	21.12.10873.0	2022-01-18	2 versions
CVE-2023-3405US	high7.5	0.84% (58th)	—	23.6.12695.3	2023-06-27	0 → 23.6.12695.3
CVE-2023-0383US	high7.5	0.84% (58th)	—	23.4.12528.1	2023-04-20	0 → 23.4.12528.1
CVE-2023-0384US	high7.5	0.80% (56th)	—	23.4.12528.1	2023-04-20	0 → 23.4.12528.1
CVE-2023-0382US	medium6.5	0.79% (56th)	—	23.4.12528.1	2023-04-05	0 → 23.4.12528.1
CVE-2023-6117US	high7.5	0.71% (53rd)	—	23.11.13156.0	2023-11-22	0 → 23.11.13156.0
CVE-2023-3425US	medium5.3	0.66% (51st)	—	23.8.12892.6	2023-08-25	0 → 23.8.12892.6
CVE-2022-1911US	medium5.3	0.62% (49th)	—	22.6.11534.1	2022-11-30	2 versions
CVE-2024-10127US	critical9.8	0.61% (49th)	—	24.11	2024-11-20	< 24.11
CVE-2023-6239US	high8.8	0.57% (47th)	—	23.11.13168.7	2023-11-28	3 versions
CVE-2021-41809US	medium4.3	0.56% (46th)	—	22.1.11017.1	2022-01-18	Online → 22.1.11017.1
CVE-2024-6789US	medium6.5	0.56% (46th)	—	24.8.13981.0	2024-08-27	2 versions
CVE-2025-0635US	high7.5	0.53% (45th)	—	25.1.14445.5	2025-01-23	< 25.1.14445.5
CVE-2025-0648US	medium4.9	0.51% (44th)	—	25.1.14445.5	2025-01-23	< 25.1.14445.5
CVE-2023-6189US	medium5.3	0.51% (43rd)	—	23.11.13156.0	2023-11-22	0 → 23.11.13156.0
CVE-2022-1606US	medium4.3	0.48% (42nd)	—	22.3.11237.1	2022-11-30	2 versions
CVE-2022-4858US	high7.5	0.48% (41st)	—	22.10.11846.0	2022-12-30	0 → 22.10.11846.0
CVE-2025-13008US	—	0.48% (41st)	—	LTS 24.8 SR5	2025-12-19	4 versions
CVE-2025-3086US	high7.1	0.42% (36th)	—	5.3.14549	2025-04-04	< 5.3.14549
CVE-2025-0619US	medium4.9	0.42% (36th)	—	25.1.14445.5	2025-01-23	< 25.1.14445.5
CVE-2025-11681US	medium6.5	0.41% (35th)	—	25.11.15392.1	2025-11-17	< 25.11.15392.1
CVE-2026-0931US	—	0.41% (35th)	—	26.5.16015.3	2026-08-05	< 26.5.16015.3
CVE-2026-0663US	medium4.9	0.41% (35th)	—	26.1.15632.3	2026-01-21	< 26.1.15632.3
CVE-2024-10126US	medium4.3	0.39% (32nd)	—	24.11	2024-11-20	< 24.11
CVE-2025-14267US	medium4.9	0.38% (32nd)	—	LTS 25.2 SR3	2025-12-19	4 versions
CVE-2025-14318US	medium4.3OT elevated	0.31% (23rd)	—	25.12	2025-12-18	< 25.12
CVE-2021-41808US	low2.3	0.25% (16th)	—	21.11.10775.0	2022-01-18	2 versions
CVE-2026-0983US	—	0.23% (13th)	—	26.5.16015.0	2026-05-18	3 versions
CVE-2025-2159US	—	0.22% (13th)	—	no fix	2025-04-04	≤ Admin Tool <25.3.14681.7
CVE-2026-0932US	high7.3	0.19% (9th)	—	26.3.15818.5	2026-04-01	< 26.3.15818.5

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption4 CVEs
CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-1286Improper Validation of Syntactic Correctness of Input3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-248Uncaught Exception2 CVEs
CWE-532Insertion of Sensitive Information into Log File2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-125Out-of-bounds Read1 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)17 CVEs
EUEU Vulnerability Database (ENISA)14 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan