Low · 3.5 CVE-2021-41809 EUVD-2021-28814GHSA-wrw2-8vg5-g3jj

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.

Published Jan 18, 2022 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Server	Online – < 22.1.11017.1	22.1.11017.1

References

https://www.m-files.com/about/trust-center/security-vulnerabilities/cve-2021-41809/
https://empower.m-files.com/security-advisories/CVE-2021-41809 vendor-advisory