VULNERABILITY INTELLIGENCE
CVE-2025-13008
EPSS probability0.48%
CISA KEVNot currently listed
Published2025-12-19
Last modified2026-09-25
Description
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
Weakness classification
- security@m-files.com: CWE-359