Description
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| M-Files | M-Files Web | < 26.8.16330.2 | 26.8.16330.2 |
References
- https://empower.m-files.com/security-advisories/CVE-2026-18372 vendor-advisory