CVE-2026-18372

MediumCVSS 4.8

Published: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Summary

CSS injection vulnerability in M-Files Web before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS, affecting the web UI shown to other vault users.

Risk Assessment

Risk of altering the interface appearance for other users, potentially leading to phishing or misleading content.

Recommendation

Update M-Files Web to version 26.8.16330.2 or later to fix the vulnerability.

Original NVD description (English source)

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.