PT-2026-78326 · M Files · M-Files Web
CVE-2026-18372
·
Published
2026-08-19
·
Updated
2026-08-20
CVSS v4.0
4.8
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
M-Files Web versions prior to 26.8.16330.2
Description
An authenticated vault administrator can inject arbitrary CSS into the web user interface. This allows the administrator to modify the visual presentation of the interface as displayed to other vault users.
Recommendations
Update to version 26.8.16330.2 or later.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
M-Files Web