CVE-2025-14267
Sensitive Data Exposure in M-Files Server Before
Publication date: 2025-12-19
Last updated on: 2026-02-23
Assigner: M-Files Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| m-files_corporation | m-files_server | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-212 | The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves incomplete removal of sensitive information, including potentially personally identifiable information (PII), during vault copy operations. Such unintended data leakage could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over the handling and transfer of sensitive data. Therefore, organizations using affected versions of M-Files Server may face compliance risks until they upgrade to the fixed version that properly removes cached sensitive data. [1]
Can you explain this vulnerability to me?
CVE-2025-14267 is a vulnerability in M-Files Server versions before 25.12.15491.7 where sensitive temporary cached data is not properly removed during a 'metadata structure only' vault copy operation. This causes sensitive information such as file names, user names, comments, and potentially personally identifiable information (PII) to be inadvertently included in the copied vault. The issue occurs because activity feed data from the source vault is not cleared correctly, leading to data leakage into the new vault, sometimes appearing as random activity feed data from another vault. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unintended exposure of sensitive information, including file names, user names, comments, and possibly personally identifiable information (PII). Such data leakage could compromise confidentiality and privacy by allowing unauthorized access to sensitive cached activity data when copying vault metadata structures. The impact depends on the source vault's content and could result in sensitive data appearing in unrelated vault copies. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves checking for vaults created as 'metadata structure only' copies that may contain residual activity feed data such as file names, user names, and comments from the source vault. Since the vulnerability causes random activity feed data from another vault to appear in copied vaults, administrators should inspect copied vaults for unexpected or inconsistent activity feed entries. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade M-Files Server to version 25.12.15491.7 or later, which resolves the issue by properly removing cached activity data during the database update. No additional mitigation steps are required beyond this upgrade. [1]