CVE-2025-13008 — Session Token Disclosure in M-Files Web
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Fil…
Published: 2025-12-19 · CVSS: 8.6 · CVSS 4.0
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7