CVE-2025-13008
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
Risk Assessment
An attacker can hijack other users' sessions, potentially leading to unauthorized data access and actions on their behalf. The risk includes breach of confidentiality and integrity.
Recommendation
Update M-Files Server to version 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 or 24.8 LTS SR5 (or later). Monitor for suspicious session activity.
Other vulnerabilities in M-Files Server
See all- CVE-2026-0983High
In M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3, a denial-of-service vulnerability exists. This allows an authenticated user to cause the MFserver process to crash.
- CVE-2026-0931Medium
Denial-of-service vulnerability in M-Files Server before version 26.5.16015.3 allows an authenticated admin user to crash the server process and prevent it from restarting.
- CVE-2023-3425Medium
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
- CVE-2023-3405High
Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service.
Original NVD description (English source)
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS