CVE-2025-14318

Unknown Unknown - Not Provided

Improper Access Control in M-Files Server Enables Unauthorized File Download

Publication date: 2025-12-18

Last updated on: 2026-02-23

Assigner: M-Files Corporation

Description

Improper access checks in M-Files Server before 25.12 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module being enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2026-02-23

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14318

Affected Vendors & Products

Vendor	Product	Version / Range
m-files	m-files_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Compliance Impact

This vulnerability undermines the effectiveness of the Print and Download Prevention module from the M-Files Compliance Kit, potentially allowing unauthorized file downloads. Such unauthorized access could lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on data access and prevention of unauthorized data disclosure. [1]

Executive Summary

CVE-2025-14318 is an improper access validation vulnerability in M-Files Server versions before 25.12. It allows users to download files through M-Files Web using the Web Companion feature even when the Print and Download Prevention module is enabled. This happens because of incorrect authorization checks, enabling unauthorized file downloads despite intended restrictions. [1]

Impact Analysis

This vulnerability can allow users with limited privileges to bypass the Print and Download Prevention controls and download files they should not be able to access. This could lead to unauthorized access and distribution of sensitive or restricted files, potentially compromising data confidentiality. [1]

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your M-Files Server to version 25.12 or later, as versions prior to 25.12 are affected. Additionally, review and verify the configuration of the Print and Download Prevention module from the M-Files Compliance Kit to ensure it is properly enforced after the upgrade. [1]

Hi! I’m here to help you understand CVE-2025-14318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70