CVE-2026-18371: HTML injection in M-Files Web

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-10-22
Weakness: CWE-79

Description

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.

Affected products

M-Files Corporation M-Files Web: before 26.8.16330.2 — fixed in 26.8.16330.2

How to fix

Upgrade to a fixed version: M-Files Corporation M-Files Web 26.8.16330.2. Check the vendor advisory for mitigations.

References

https://empower.m-files.com/security-advisories/CVE-2026-18371

Get alerted when CVE-2026-18371 or the next vulnerability affects your stack