CVE-2025-13008

The record

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

Affected packages

Related vulnerabilities

• CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
• CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
• CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
• CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
• CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
• CVE-2026-58297 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
• CVE-2026-58296 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
• CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in… CWE-359