What’s Vulnerable › Vulnerabilities

CVE-2025-5964: Path traversal in M-Files API

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-15 · updated 2026-06-17
• Weakness: CWE-22

Description

A path traversal issue in the API endpoint in M-Files Server before version 25.6.14925.0 allows an authenticated user to read files in the server.

Affected products

• M-Files Corporation M-Files Server: before 24.8.13981.16; from 25.2.14524.3 before 25.2.14524.9; from 25.3.14681.7 before 25.6.14925.0 — fixed in 24.8.13981.16, 25.2.14524.9, 25.6.14925.0

How to fix

Upgrade to a fixed version: M-Files Corporation M-Files Server 24.8.13981.16, 25.2.14524.9, 25.6.14925.0. Check the vendor advisory for mitigations.

References

• https://empower.m-files.com/security-advisories/CVE-2025-5964
• https://product.m-files.com/security-advisories/cve-2025-5964

Get alerted when CVE-2025-5964 or the next vulnerability affects your stack