PT-2026-29509
CVE-2026-0932
·
Published
2026-04-01
·
Updated
2026-04-01
Description by
CVSS 3.1
7.3
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
M-Files Server versions prior to 26.3
Description
A blind server-side request forgery (SSRF) vulnerability exists in legacy connection methods of document co-authoring features. An unauthenticated attacker can cause the server to send HTTP GET requests to arbitrary URLs.
Recommendations
Update M-Files Server to version 26.3 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾