CVE-2022-4862: M-Files Server

High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3.

Affected products

• M-Files M-Files Server: before 22.12.12140.3 (fixed in 22.12.12140.3)

Published 2023-03-06. Last modified 2026-06-17.