Medium · 5.1 CVE-2025-2159 EUVD-2025-9688GHSA-pc6c-whfr-9343

Stored XSS in M-Files Admin user interface

Published Apr 4, 2025 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Vendor: M-Files Product: M-Files Admin

Description

Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI

Affected products

Vendor	Product	Affected	Fixed
M-Files	M-Files Admin	< 25.3.14681.7	25.3.14681.7

Advisories 1

WID-SEC-2025-0707 M-Files Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 3, 2025

References

https://product.m-files.com/security-advisories/cve-2025-2159/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2025-2159 vendor-advisory