CVE-2026-0932

HIGH

M-files Corporation M-files Server < 26.3.15818.5 - SSRF

Title source: rule
STIX 2.1

Description

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.

References (2)

Scores

CVSS v3 7.3
EPSS 0.0006
EPSS Percentile 19.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (2)
m-files/m-files_server < 26.3.15818.5
M-Files Corporation/M-Files Server < 26.3.15818.5
Published Apr 01, 2026
Tracked Since Apr 01, 2026