A critical security flaw has been discovered in M-Files Server, a document management system, that could potentially grant unauthorized access to sensitive information. This vulnerability, known as CVE-2025-13008, is a serious concern for organizations relying on M-Files for their critical data management.
The flaw allows authenticated attackers to capture session tokens of other active users, essentially giving them the keys to impersonate legitimate users and execute actions on their behalf. With these tokens, threat actors can access confidential documents and even modify critical information without raising any red flags.
This vulnerability is classified as CWE-359, which relates to the exposure of private personal information to unauthorized individuals. It's a classic case of session replay, as defined by CAPEC-60.
What makes this vulnerability particularly worrying is its high severity rating of 8.6 on the CVSS 4.0 scale. It affects multiple versions of M-Files Server, including the current release and several long-term support (LTS) branches.
Here's a breakdown of the affected versions and the corresponding patched versions that organizations should prioritize:
- Current Release: Before 25.12.15491.7, patch to 25.12.15491.7
- LTS 25.8: Before SR3, patch to 25.8.15085.18 (SR3)
- LTS 25.2: Before SR3, patch to 25.2.14524.14 (SR3)
- LTS 24.8: Before SR5, patch to 24.8.13981.17 (SR5)
M-Files has released patched versions to address this vulnerability, and no public exploits have been reported so far. However, the potential impact of a successful attack is significant, including unauthorized document access and potential lateral movement within enterprise systems.
Therefore, organizations should treat this issue with the utmost urgency and prioritize testing and deploying the patches across all affected M-Files Server instances.
Additionally, security teams should monitor access logs for any signs of suspicious user activity, such as token theft or unauthorized account usage.
Stay vigilant and keep your systems secure! Remember, in the world of cybersecurity, it's always better to be safe than sorry.
