CVE-2021-37253: M-Files Web

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is disputed because the range behavior is the responsibility of the web server, not the responsibility of the individual web application

Affected products

• M-Files M-Files Web: before 20.10.9524.1 (fixed in 20.10.9524.1)

Published 2021-12-05. Last modified 2026-06-17.