CVE-2025-2159: Stored XSS in M-Files Admin user interface
Published Apr 4, 2025
·Updated
Stored XSS in Desktop UI in M-Files Server Admin tool before version 25.3.14681.7 on Windows allows authenticated local user to run scripts via UI
Affected Software
1 affected component
M-Files M-Files Server Admin<25.3.14681.7
Event History
Apr 4, 2025
CVE Published
via MITRE·06:06 AM
Data Sourced
via MITRE·06:06 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-2159?
CVE-2025-2159 has a high severity rating due to its potential for exploitation through stored XSS vulnerabilities.
2
How do I fix CVE-2025-2159?
To fix CVE-2025-2159, upgrade to M-Files Server Admin version 25.3.14681.7 or later.
3
Who is affected by CVE-2025-2159?
Authenticated local users of M-Files Server Admin versions before 25.3.14681.7 on Windows are affected by CVE-2025-2159.
4
What type of vulnerability is CVE-2025-2159?
CVE-2025-2159 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
5
Can CVE-2025-2159 be exploited remotely?
No, CVE-2025-2159 can only be exploited by authenticated local users.