CVE-2025-11681
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In M-Files Server before versions 25.11.15392.1, 25.2 LTS SR2, and 25.8 LTS SR2, there is a denial-of-service vulnerability. An authenticated user can cause the MFserver process to crash.
Risk Assessment
An authenticated user can cause the server to crash, leading to unavailability of services for all users. This may disrupt organizational operations.
Recommendation
Update M-Files Server to versions 25.11.15392.1, 25.2 LTS SR2, or 25.8 LTS SR2 where the vulnerability is patched.
Other vulnerabilities in M-Files Server
See all- CVE-2026-0983High
In M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3, a denial-of-service vulnerability exists. This allows an authenticated user to cause the MFserver process to crash.
- CVE-2026-0931Medium
Denial-of-service vulnerability in M-Files Server before version 26.5.16015.3 allows an authenticated admin user to crash the server process and prevent it from restarting.
- CVE-2025-13008High
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
- CVE-2023-3425Medium
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
- CVE-2023-3405High
Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service.
Original NVD description (English source)
Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS