CVE-2025-11681CWE-400denial-of-service

CVE-2025-11681

Medium · published November 17, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authenticated user to cause the MFserver process to crash.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-11-17T17:15Z
Affected products (3)
ProductVersionsFixed in
m-files/m-files_server< 25.2.14524.1325.2.14524.13
m-files/m-files_server< 25.11.15392.125.11.15392.1
m-files/m-files_server≥ 25.8.15085.13, < 25.8.15085.1725.8.15085.17
References (2)
https://empower.m-files.com/security-advisories/CVE-2025-11681 · [email protected]https://product.m-files.com/security-advisories/cve-2025-11681/ · [email protected]
EPSS history
Timeline
  • 17 NOV 11:30Z
    Denial of Service condition in M-Files Server
    cvelistv5