What is the CVSS score of CVE-2025-5964?

CVE-2025-5964 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of M Files Server are affected by CVE-2025-5964?

Organizations using the API endpoint in M-Files Server should be aware of notable risk from CVE-2025-5964, a path traversal vulnerability rated CVSS 6.5. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2025-5964?

Within 30 days: Identify affected systems running the API endpoint in M-Files Server and apply vendor patches as part of regular patch cycle. Review file handling controls.

M Files Server CVE-2025-5964

EUVD-2025-18348 MEDIUM

Path Traversal (CWE-22)

2025-06-15 security@m-files.com

Path Traversal M Files Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

25.6.14925.0

EUVD ID Assigned

Mar 14, 2026 - 21:57 euvd

EUVD-2025-18348

Analysis Generated

Mar 14, 2026 - 21:57 vuln.today

CVE Published

Jun 15, 2025 - 20:15 nvd

MEDIUM 6.5

DescriptionCVE.org

A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server.

Analysis

A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server.

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in M Files Server

View all

CVE-2023-6912 CRITICAL Act Now

9.8 Dec 20

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authe

CVE-2024-10127 CRITICAL Act Now

9.2 Nov 20

Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLD

CVE-2023-6239 HIGH This Week

8.8 Nov 28

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specif

CVE-2024-6789 HIGH This Week

8.4 Aug 27

A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 2

CVE-2023-2112 HIGH This Week

7.8 Apr 20

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. Rated high severity (

CVE-2024-4056 HIGH This Week

7.5 Apr 26

Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allow

CVE-2023-6117 HIGH This Week

7.5 Nov 22

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API me

CVE-2023-3405 HIGH This Week

7.5 Jun 27

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonym

CVE-2023-0384 HIGH This Week

7.5 Apr 20

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolle

CVE-2023-0383 HIGH This Week

7.5 Apr 20

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolle

CVE-2022-4858 HIGH This Week

7.5 Dec 30

Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive

CVE-2026-0983 HIGH This Week

7.1 May 18

Denial of service in M-Files Server versions prior to 26.5.16015.0, 26.2 LTS, and 25.8 LTS SR3 allows an authenticated r

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

CVE-2018-13379 CRITICAL POC

9.1

CVE-2015-0016 HIGH POC

7.8

Same technique Path Traversal

View all

CVE-2025-64446 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2016-0752 HIGH POC

7.5

CVE-2024-13159 CRITICAL POC

9.8

CVE-2024-13160 CRITICAL POC

9.8

CVE-2024-13161 CRITICAL POC

9.8

CVE-2014-0780 CRITICAL POC

9.8

CVE-2024-48248 HIGH POC

8.6

CVE-2025-5964 vulnerability details – vuln.today

Back

M Files Server CVE-2025-5964

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in M Files Server

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Share

External POC / Exploit Code