PT-2025-14853 · M Files · M-Files Server Admin Tool

Published 2025-04-04 · Updated 2025-04-04 · CVE-2025-2159

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions M-Files Server Admin tool versions prior to 25.3.14681.7

Description The issue concerns a stored XSS in the desktop UI of the M-Files Server Admin tool. This allows authenticated local users to execute scripts through the UI.

Recommendations For versions prior to 25.3.14681.7, update to version 25.3.14681.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the desktop UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-2159

Affected Products

M-Files Server Admin Tool

References · 7

• https://empower.m-files.com/security-advisories/CVE-2025-2159 · Vendor Advisory
• https://product.m-files.com/security-advisories/cve-2025-2159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2159 · Security Note
• https://twitter.com/CVEnew/status/1908072003703087190 · Twitter Post
• https://t.me/cvetracker/20785 · Telegram Post
• https://t.me/cvedetector/22096 · Telegram Post
• https://t.me/cvenotify/117698 · Telegram Post