Loading vulnerability…
Session token disclosure in M-Files Server (M-Files Web)
CVE-2025-13008 is an information disclosure issue in M-Files Server (via the M-Files Web interface) affecting versions prior to 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5. An authenticated attacker using M-Files Web can capture session tokens belonging to other active users, enabling reuse of those tokens to impersonate victims and access resources under the victims’ authorization context.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables session hijacking by exposing other users’ session tokens. This can result in unauthorized access to sensitive content managed in M-Files (e.g., documents/metadata) and the ability to perform actions as the impersonated user, with potential for follow-on abuse depending on the victim’s privileges.
If you can’t patch tonight, do this now.
If immediate patching is not possible, limit exposure of M-Files Web to trusted networks/users (e.g., VPN-only or restricted ingress), enforce least privilege and strong authentication, and reduce token usefulness by shortening session lifetimes and/or forcing re-authentication where feasible. Monitor access/authentication logs for indicators of token theft or anomalous session reuse.
Patch, then assume compromise.
Upgrade M-Files Server to a fixed release: 25.12.15491.7 or later, or apply the relevant LTS service release (25.8 LTS SR3, 25.2 LTS SR3, or 24.8 LTS SR5) or later.
No public exploits tracked yet. Mallory keeps watching.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.