CVE-2026-18372: CSS injection in M-Files Web

Severity: medium (CVSS 4.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-10-22
Weakness: CWE-79

Description

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.

Affected products

M-Files Corporation M-Files Web: before 26.8.16330.2 — fixed in 26.8.16330.2

How to fix

Upgrade to a fixed version: M-Files Corporation M-Files Web 26.8.16330.2. Check the vendor advisory for mitigations.

References

https://empower.m-files.com/security-advisories/CVE-2026-18372

Get alerted when CVE-2026-18372 or the next vulnerability affects your stack