CVE-2025-14318
Unknown Unknown - Not Provided
Improper Access Control in M-Files Server Enables Unauthorized File Download

Publication date: 2025-12-18

Last updated on: 2026-02-23

Assigner: M-Files Corporation

Description
Improper access checks in M-Files Server before 25.12 allows users to download files through M-Files Web using Web Companion despite Print and Download Prevention module being enabled.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-18
Last Modified
2026-02-23
Generated
2026-06-16
AI Q&A
2025-12-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14318
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
m-files m-files_server *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-14318 is an improper access validation vulnerability in M-Files Server versions before 25.12. It allows users to download files through M-Files Web using the Web Companion feature even when the Print and Download Prevention module is enabled. This happens because of incorrect authorization checks, enabling unauthorized file downloads despite intended restrictions. [1]

Impact Analysis

This vulnerability can allow users with limited privileges to bypass the Print and Download Prevention controls and download files they should not be able to access. This could lead to unauthorized access and distribution of sensitive or restricted files, potentially compromising data confidentiality. [1]

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your M-Files Server to version 25.12 or later, as versions prior to 25.12 are affected. Additionally, review and verify the configuration of the Print and Download Prevention module from the M-Files Compliance Kit to ensure it is properly enforced after the upgrade. [1]

Compliance Impact

This vulnerability undermines the effectiveness of the Print and Download Prevention module from the M-Files Compliance Kit, potentially allowing unauthorized file downloads. Such unauthorized access could lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on data access and prevention of unauthorized data disclosure. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14318. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart