CVE-2023-2325: Stored XSS Vulnerability in M-Files Classic Web

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-20 · updated 2026-06-17
Weakness: CWE-79

Description

Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.

Affected products

M-Files Web: before 23.10; 23.2, 23.8 — fixed in 23.10

How to fix

Upgrade to a fixed version: M-Files Web 23.10. Check the vendor advisory for mitigations.

References

https://empower.m-files.com/security-advisories/CVE-2023-2325
https://product.m-files.com/security-advisories/cve-2023-2325/
https://www.m-files.com/about/trust-center/security-advisories/cve-2023-2325/

Get alerted when CVE-2023-2325 or the next vulnerability affects your stack