CVE-2025-0648: M-Files Server

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3 allows a highly privileged attacker to cause denial of service via configuration change.

Affected products

• M-Files M-Files Server: before 24.8.13981.14 (fixed in 24.8.13981.14); from 24.9.14055.3, before 25.1.14445.5 (fixed in 25.1.14445.5)

Published 2025-01-23. Last modified 2026-06-17.