Information Disclosure in M-Files Server Affects User Sessions
CVE-2025-13008

8.6HIGH

Key Information:

Vendor

M-files Corporation

Status
M-files Server
Vendor
CVE Published:
19 December 2025

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2025-13008?

An information disclosure vulnerability exists in M-Files Server that allows authenticated users to exploit the system via M-Files Web. By capturing session tokens of other active users, an attacker can gain unauthorized access and potentially manipulate sensitive data. It is crucial for organizations using affected versions of M-Files Server to update their systems promptly to safeguard against this security risk.

Affected Version(s)

M-Files Server 0 < 25.12.15491.7

M-Files Server 25.8.15085.18

M-Files Server 25.2.14524.14

News Articles

favicon imagegbhackers.com

M-Files Vulnerability Allows Attackers to Steal Active User Session Tokens

A critical vulnerability in M-Files Server could allow authenticated attackers to capture active user session tokens.

References

https://product.m-files.com/security-advisories/cve-2025-...
vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2025-...
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by gbhackers.com

  • Vulnerability published

  • Vulnerability Reserved

.