CVE-2025-13008NVD

Vulnerability Summary

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

Severity Level

HIGH(8.6)

Published Date

Dec 19, 2025

Last Modified

Feb 23, 2026

Exploitation Status

????

EPSS Score (30-Day)

0.02%Probability

Root Weakness (CWE)

CWE-359: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v4.0 Base Metrics

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

External References

https://empower.m-files.com/security-advisories/CVE-2025-13008
https://product.m-files.com/security-advisories/cve-2025-13008