PT-2025-3994 · M Files · M-Files Server

Published 2025-01-23 · Updated 2025-10-03 · CVE-2025-0648

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 25.1.14445.5 M-Files Server versions prior to 24.8 LTS SR3

Description The issue allows a highly privileged attacker to cause a denial of service via a configuration change, resulting in an unexpected server crash in the database driver.

Recommendations For versions prior to 25.1.14445.5, update to version 25.1.14445.5 or later. For versions prior to 24.8 LTS SR3, update to 24.8 LTS SR3 or later.

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2025-0648

Affected Products

M-Files Server

References · 9

• https://osv.dev/vulnerability/CVE-2025-0648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0648 · Security Note
• https://product.m-files.com/security-advisories/cve-2025-0648 · Vendor Advisory
• https://empower.m-files.com/security-advisories/CVE-2025-0648 · Vendor Advisory
• https://t.me/cvedetector/16171 · Telegram Post
• https://t.me/cvenotify/111564 · Telegram Post
• https://t.me/cvenotify/108343 · Telegram Post
• https://t.me/cveNotify/137301 · Telegram Post
• https://twitter.com/CVEnew/status/1882389046615293986 · Twitter Post