PT-2025-14853 · M Files · M-Files Server Admin Tool
CVE-2025-2159
·
Published
2025-04-04
·
Updated
2025-04-04
CVSS v4.0
5.1
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
M-Files Server Admin tool versions prior to 25.3.14681.7
Description
The issue concerns a stored XSS in the desktop UI of the M-Files Server Admin tool. This allows authenticated local users to execute scripts through the UI.
Recommendations
For versions prior to 25.3.14681.7, update to version 25.3.14681.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the desktop UI to minimize the risk of exploitation.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
M-Files Server Admin Tool