Medium · 5.0 CVE-2022-4862 EUVD-2022-52128GHSA-j6v8-rcm6-wxr2

XSS vulnerability in M-Files Web

Published Mar 6, 2023 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Vendor: M-Files Product: M-Files New Web

Description

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information.

This issue affects M-Files New Web: before 22.12.12140.3.

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files New Web	< 22.12.12140.3	22.12.12140.3

References

https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4862/
https://product.m-files.com/security-advisories/cve-2022-4862/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2022-4862 vendor-advisory