Which versions of M-Files Server are affected by CVE-2025-13008?

M-Files Server is affected by a session token disclosure vulnerability that could let an authenticated low-privileged user impersonate other active M-Files Web users, creating account takeover and…

How to fix or mitigate CVE-2025-13008?

Within 24 hours, confirm whether your M-Files Server deployment is affected by checking versions against all releases before 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5, and review M-Files Web logs for suspicious concurrent sessions or token replay activity. Within 7 days, implement compensating controls by restricting M-Files Web client access to trusted networks or VPN, enforcing short session timeouts and periodic re-authentication, limiting low-privileged accounts, and closely monitoring for anomalous session reuse; engage M-Files support to obtain any available workarounds and a patch timeline. Within 30 days, plan to test and deploy vendor-released updates for versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5 as soon as they are available, and if no patch is released, maintain the interim controls, conduct a focused access log review, and brief M-Files Web users on session security.

M-Files Server CVE-2025-13008

Q: What is the CVSS score of CVE-2025-13008?

CVE-2025-13008 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2025-12-19 security@m-files.com

Information Disclosure

8.6

CVSS 4.0 · Vendor: m-files

Severity by source

Vendor (m-files) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Authenticated M-Files Web user (PR:L) needs other users active (UI:R); captured tokens grant cross-user session takeover, crossing security scope (S:C) with high confidentiality/integrity but no direct availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (m-files).

CVSS VectorVendor: m-files

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Sep 25, 2026 - 23:42 vuln.today

CVE Published

Dec 19, 2025 - 07:15 cve.org

HIGH 8.6

DescriptionCVE.org

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

AnalysisAI

Session token disclosure in M-Files Server (all releases before 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5) lets an authenticated attacker using the M-Files Web client capture the live session tokens of other users who are concurrently active in the web interface. The captured tokens can then be replayed to impersonate those victims, giving high confidentiality and integrity impact across account boundaries, as reflected in our assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. Exploitation requires a valid low-privileged M-Files Web account plus the presence of other active sessions, which meaningfully constrains real-world risk; there is no public exploit code identified at time of analysis and no CISA KEV listing, and EPSS is low at 0.48% (39th percentile), so this is an above-average-priority issue rather than an emergency.

Technical ContextAI

M-Files Server is an enterprise document management and content-services platform, and M-Files Web is its browser-based client. Web clients authenticate users by issuing session tokens (session cookies or bearer credentials) that are presented on subsequent requests, so possession of a valid token is sufficient to act as that user without re-entering credentials. This issue is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), with the exposed material here being authentication session tokens rather than ordinary data. The flaw enables one authenticated web-client user to obtain the session tokens belonging to other users who are active at the same time, a classic session-hijacking primitive that crosses a trust boundary between accounts (hence the scope change in the assessed vector) and yields full impersonation of each captured victim. Our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N (network reachable, low complexity, authenticated attacker, victim-side user interaction/dependency on live victims, changed scope, high confidentiality and integrity impact, no availability impact), which is more conservative in some respects than the submitted CVSS 4.0 base score of 8.6 but regionally consistent with it. No CPE strings were provided in the input, so affected deployments must be identified by product and version rather than by CPE matching.

Affected ProductsAI

M-Files Server is affected in all builds prior to 25.12.15491.7; on the long-term-support tracks the issues are fixed in 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5, so any deployment on 25.8 LTS before SR3, 25.2 LTS before SR3, or 24.8 LTS before SR5 is exposed. Exposure applies specifically to installations where the M-Files Web client is enabled, since the token capture is performed through the web interface, and no exotic configuration is required for default web-enabled deployments to be vulnerable. No CPE identifiers were supplied in the source data, so inventory should be matched against the vendor advisories at https://empower.m-files.com/security-advisories/CVE-2025-13008 and https://product.m-files.com/security-advisories/cve-2025-13008, which enumerate the exact server builds considered fixed.

RemediationAI

Apply the vendor fix: upgrade M-Files Server to 25.12.15491.7 or later, or on the LTS lines move to 25.8 LTS SR3, 25.2 LTS SR3, or 24.8 LTS SR5, following the instructions in the advisories at https://product.m-files.com/security-advisories/cve-2025-13008 and https://empower.m-files.com/security-advisories/CVE-2025-13008; the status is 'Vendor-released patch: 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, 24.8 LTS SR5'. After upgrading, invalidate existing sessions (force re-login/restart the M-Files Web tier) so that any tokens captured before the patch cannot be replayed, since patched code does not retroactively revoke tokens an attacker already holds. Until patching is possible, compensating controls include restricting who can reach the M-Files Web endpoint (place it behind VPN or an allow-listed reverse proxy, acknowledging that this reduces mobile/remote usability) and limiting the number of simultaneously active privileged accounts so there are fewer live tokens of value to steal. Reducing web session idle and absolute timeouts shortens the window in which a captured token remains usable, at the cost of more frequent re-authentication for users, and deploying anomaly detection on session reuse from unfamiliar source IPs or user agents can surface token replay, though it detects rather than prevents the capture itself. Enforcing MFA limits credential-based attacks but does not prevent replay of an already captured valid session token, so it should not be treated as a substitute for patching.