PT-2026-29509 · M Files · M-Files Server

Sina Kheirkhah · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-0932

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 26.3

Description A blind server-side request forgery (SSRF) vulnerability exists in legacy connection methods of document co-authoring features. An unauthenticated attacker can cause the server to send HTTP GET requests to arbitrary URLs.

Recommendations Update M-Files Server to version 26.3 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-0932

Affected Products

M-Files Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-0932 · Security Note
• https://product.m-files.com/security-advisories/cve-2026-0932 · Vendor Advisory
• https://empower.m-files.com/security-advisories/CVE-2026-0932 · Vendor Advisory
• https://twitter.com/CVEnew/status/2039372067494084721 · Twitter Post