CVE-2025-14318
Improper Access Control in M-Files Server Enables Unauthorized File Download
Publication date: 2025-12-18
Last updated on: 2026-02-23
Assigner: M-Files Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| m-files | m-files_server | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability undermines the effectiveness of the Print and Download Prevention module from the M-Files Compliance Kit, potentially allowing unauthorized file downloads. Such unauthorized access could lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on data access and prevention of unauthorized data disclosure. [1]
Can you explain this vulnerability to me?
CVE-2025-14318 is an improper access validation vulnerability in M-Files Server versions before 25.12. It allows users to download files through M-Files Web using the Web Companion feature even when the Print and Download Prevention module is enabled. This happens because of incorrect authorization checks, enabling unauthorized file downloads despite intended restrictions. [1]
How can this vulnerability impact me? :
This vulnerability can allow users with limited privileges to bypass the Print and Download Prevention controls and download files they should not be able to access. This could lead to unauthorized access and distribution of sensitive or restricted files, potentially compromising data confidentiality. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your M-Files Server to version 25.12 or later, as versions prior to 25.12 are affected. Additionally, review and verify the configuration of the Print and Download Prevention module from the M-Files Compliance Kit to ensure it is properly enforced after the upgrade. [1]