Information Disclosure in M-Files Server Affects User Sessions

CVE-2025-13008

What is CVE-2025-13008?

An information disclosure vulnerability exists in M-Files Server that allows authenticated users to exploit the system via M-Files Web. By capturing session tokens of other active users, an attacker can gain unauthorized access and potentially manipulate sensitive data. It is crucial for organizations using affected versions of M-Files Server to update their systems promptly to safeguard against this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

News Articles

gbhackers.com

CVE-2025-13008

M-Files Vulnerability Allows Attackers to Steal Active User Session Tokens

A critical vulnerability in M-Files Server could allow authenticated attackers to capture active user session tokens.

References