M-Files Corporation
First CVE: Jan 18, 2022Active for: 5 years
57
CVEs Published
More CVEs Published than 61% of tracked CNAs
11.4
Avg CVEs / Year
More Avg CVEs / Year than 57% of tracked CNAs
6.2
Avg CVSS Score
Higher Avg CVSS Score than 15% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Self-Reporting Analysis
Of all the CVEs published by M-Files Corporation as a CNA, 94.7% affect products that M-Files Corporation develops as a vendor.
94.7%
Self-reported: 54Third-party: 3
Of all the CVEs published that affect products developed by M-Files Corporation, 90.0% are self-published by M-Files Corporation as a CNA.
90.0%
Self-published: 54Published by other CNAs: 6
Trends Over Time
The number and severity of CVEs published by M-Files Corporation over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 18, 2022
4 years ago
Most Recent CVE
May 18, 2026
68 days ago
Top CVEs
All CVEs published by M-Files Corporation as a CNA, regardless of affected vendor or product.
57 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-13008HIGH An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files | Dec 19, 2025 | 8.6 | 29 | NO | NO |
CVE-2024-10127CRITICAL Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a | Nov 20, 2024 | 9.8 | 29 | NO | NO |
CVE-2021-41807CRITICAL Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefo | Jan 18, 2022 | 9.8 | 29 | NO | NO |
CVE-2026-0983HIGH Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to c | May 18, 2026 | 7.1 | 28 | NO | NO |
CVE-2023-6912CRITICAL Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-File | Dec 20, 2023 | 9.8 | 27 | NO | NO |
CVE-2023-2112HIGH Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. | Apr 20, 2023 | 7.8 | 27 | NO | NO |
CVE-2023-0213HIGH Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. | Mar 29, 2023 | 7.8 | 25 | NO | NO |
CVE-2022-4858HIGH Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set. | Dec 30, 2022 | 7.5 | 25 | NO | NO |
CVE-2026-0932HIGH Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacke | Apr 1, 2026 | 7.3 | 24 | NO | NO |
CVE-2025-5964MEDIUM A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server. | Jun 15, 2025 | 6.5 | 24 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA57 CVEs
58%
33%
Severity distribution among all CVEs352,427 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local7 (12.3%)
Network50 (87.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low56 (98.2%)
High1 (1.8%)
Unknown0 (0.0%)
User Interaction
None40 (70.2%)
Unknown0 (0.0%)
Required15 (26.3%)
Privileges Required
Low33 (57.9%)
High7 (12.3%)
None17 (29.8%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (57 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by M-Files Corporation as a CNA.
Media Mentions
Media articles that mention a CVE ID published by M-Files Corporation as a CNA — matched by CVE ID, not by organization name.