Medium · 5.6 CVE-2025-14267 EUVD-2025-204453GHSA-xcmx-jj38-v524

Unintended temporary cached data included in a structure only copy intended to be empty of data

Published Dec 19, 2025 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions before 25.12.15491.7

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Server	< 25.12.15491.7	25.12.15491.7

Advisories 1

WID-SEC-2025-2895 M-Files Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 18, 2025

References

https://product.m-files.com/security-advisories/cve-2025-14267/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2025-14267 vendor-advisory