M-Files develops a document and information management platform centered on its server, web, and cloud-based products that serve as centralized repositories for enterprise content across organizations. The vendor's vulnerability profile, while moderate in volume, concentrates within a narrow product line spanning the M-Files Server, Hubshare, and web-access clients, reflecting the focused scope of its document-centric platform. The absence of recurring weakness-class patterns in the disclosed vulnerabilities suggests a dispersed vulnerability surface rather than a structural architectural weakness, distinguishing this vendor from platforms with systematic flaws in parsing, serialization, or privilege management. Defenders should treat M-Files deployments as part of broader information-governance risk rather than as a high-criticality attack vector, and should monitor vendor advisories in coordination with document-store patching cycles. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by M Files over time
Signals from CVEs in this vendor scope (60 CVEs).
60 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-13008HIGH An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files | Dec 19, 2025 | 8.6 | 29 | NO | NO |
CVE-2024-10127CRITICAL Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a | Nov 20, 2024 | 9.8 | 29 | NO | NO |
CVE-2021-41807CRITICAL Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefo | Jan 18, 2022 | 9.8 | 29 | NO | NO |
CVE-2026-0983HIGH Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3 allows an authenticated user to cause the MFserver process to c | May 18, 2026 | 7.1 | 28 | NO | NO |
CVE-2022-39016HIGH
Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an account takeover via a crafted PDF upload. | Oct 31, 2022 | 8.8 | 28 | NO | NO |
CVE-2023-6912CRITICAL Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-File | Dec 20, 2023 | 9.8 | 27 | NO | NO |
CVE-2023-2112HIGH Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. | Apr 20, 2023 | 7.8 | 27 | NO | NO |
CVE-2021-37253HIGH M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the | Dec 5, 2021 | 7.5 | 26 | NO | NO |
CVE-2023-0213HIGH Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. | Mar 29, 2023 | 7.8 | 25 | NO | NO |
CVE-2022-4858HIGH Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set. | Dec 30, 2022 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (60 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by M Files.
Media articles that mention a CVE ID that affects a product developed by M Files — matched by CVE ID, not by vendor name.