High · 7.0 CVE-2025-9826 EUVD-2025-29173GHSA-x6wm-h4q7-p8hv

Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution …

Published Sep 15, 2025 · Updated Feb 23, 2026 · Assigned by M-Files Corporation

Description

Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users.

Affected products

Vendor	Product	Affected	Fixed
M-Files	Hubshare	< 25.8	25.8

References

https://product.m-files.com/security-advisories/cve-2025-9826/ vendor-advisory
https://empower.m-files.com/security-advisories/CVE-2025-9826 vendor-advisory