CVE-2025-13008CWE-359

CVE-2025-13008

published December 19, 2025

CVSS
8.6
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2025-12-19T12:15Z
References (2)
https://empower.m-files.com/security-advisories/CVE-2025-13008 · [email protected]https://product.m-files.com/security-advisories/cve-2025-13008 · [email protected]
EPSS history
Timeline
  • 19 DEC 07:04Z
    Session Token Disclosure in M-Files Web
    cvelistv5