PT-2025-25531 · M Files · My Files

Pasi Orovuo + 1 · Published 2025-06-16 · Updated 2025-10-29 · CVE-2025-2091

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions M-Files mobile applications for Android and iOS versions prior to 25.6.0

Description An open redirection issue allows attackers to use maliciously crafted PDF files to trick other users into making requests to untrusted URLs. This can be achieved by utilizing specially crafted PDF files to deceive users into accessing potentially harmful websites.

Recommendations For versions prior to 25.6.0, update to version 25.6.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of PDF files from untrusted sources within the M-Files mobile application until the update is applied.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-2091

Affected Products

My Files

References · 8

• https://osv.dev/vulnerability/CVE-2025-2091 · Vendor Advisory
• https://product.m-files.com/security-advisories/cve-2025-2091 · Vendor Advisory
• https://empower.m-files.com/security-advisories/CVE-2025-2091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2091 · Security Note
• https://t.me/cvetracker/26287 · Telegram Post
• https://twitter.com/CVEnew/status/1934534120471695700 · Twitter Post
• https://t.me/cveNotify/140877 · Telegram Post
• https://t.me/cvenotify/125752 · Telegram Post