Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

M Files

First CVE: Oct 28, 2021Active for: 5 yearsTotal CVEs: 117

M-Files develops a document and information management platform centered on its server, web, and cloud-based products that serve as centralized repositories for enterprise content across organizations. The vendor's vulnerability profile, while moderate in volume, concentrates within a narrow product line spanning the M-Files Server, Hubshare, and web-access clients, reflecting the focused scope of its document-centric platform. The absence of recurring weakness-class patterns in the disclosed vulnerabilities suggests a dispersed vulnerability surface rather than a structural architectural weakness, distinguishing this vendor from platforms with systematic flaws in parsing, serialization, or privilege management. Defenders should treat M-Files deployments as part of broader information-governance risk rather than as a high-criticality attack vector, and should monitor vendor advisories in coordination with document-store patching cycles. Current severity, exploitation activity, and exposure counts are shown alongside this summary.

FAUCET AI Generated
60
Total CVEs
More Total CVEs than 99% of tracked vendors
1.1
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 74% of tracked vendors
6.4
Avg CVSS Score
Higher Avg CVSS Score than 39% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by M Files over time

Volume of CVEsAvg CVSS Base Score
First CVE
Oct 28, 2021
4 years ago
Most Recent CVE
May 18, 2026
67 days ago

Products(9 total)

Top CVEs

Signals from CVEs in this vendor scope (60 CVEs).

60 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2025-13008HIGH
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files
Dec 19, 20258.629NONO
CVE-2024-10127CRITICAL
Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a
Nov 20, 20249.829NONO
CVE-2021-41807CRITICAL
Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefo
Jan 18, 20229.829NONO
CVE-2026-0983HIGH
Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to c
May 18, 20267.128NONO
CVE-2022-39016HIGH
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload.
Oct 31, 20228.828NONO
CVE-2023-6912CRITICAL
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-File
Dec 20, 20239.827NONO
CVE-2023-2112HIGH
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.
Apr 20, 20237.827NONO
CVE-2021-37253HIGH
M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the
Dec 5, 20217.526NONO
CVE-2023-0213HIGH
Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.
Mar 29, 20237.825NONO
CVE-2022-4858HIGH
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
Dec 30, 20227.525NONO
View all 60 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products60 CVEs
52%
40%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local6 (10.0%)
Network54 (90.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low59 (98.3%)
High1 (1.7%)
Unknown0 (0.0%)
User Interaction
None43 (71.7%)
Unknown0 (0.0%)
Required16 (26.7%)
Privileges Required
Low32 (53.3%)
High7 (11.7%)
None21 (35.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (60 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by M Files.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by M Files — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For M Files's Products

View all 3 CNAs →

Top CWEs