CVE-2025-13008: M-Files Server Information Disclosure

CVE-2025-13008 Overview

CVE-2025-13008 is an information disclosure vulnerability affecting M-Files Server. The flaw allows an authenticated attacker using M-Files Web to capture session tokens belonging to other active users. Successful exploitation enables session hijacking and impersonation of legitimate users within the M-Files environment.

The vulnerability is classified under [CWE-359] (Exposure of Private Personal Information to an Unauthorized Actor) and requires authenticated access combined with user interaction. M-Files has released fixed versions across multiple supported branches.

Critical Impact
An authenticated attacker can capture session tokens of other active M-Files Web users, enabling account takeover and unauthorized access to documents managed within M-Files.

Affected Products

M-Files Server versions before 25.12.15491.7
M-Files Server 25.8 LTS before SR3
M-Files Server 25.2 LTS before SR3 and 24.8 LTS before SR5

Discovery Timeline

2025-12-19 - CVE-2025-13008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13008

Vulnerability Analysis

The vulnerability resides in M-Files Server's handling of session data when accessed through the M-Files Web client. An authenticated attacker can obtain session tokens issued to other active users connected to the same server. Once captured, these tokens can be replayed to impersonate the victim and access vault contents under the victim's identity.

Session tokens in web applications act as bearer credentials. Any actor in possession of a valid token is treated as the authenticated user until the token expires or is revoked. Disclosure of these tokens collapses the boundary between authenticated user contexts.

Root Cause

The root cause is improper isolation of sensitive session data between authenticated users in the M-Files Web interface. Session identifiers that should be private to each user's authenticated context become observable by other authenticated principals. This maps to [CWE-359], where information that must remain confined to a single subject is exposed to unauthorized actors.

Attack Vector

The attack is conducted over the network against the M-Files Web endpoint. The attacker must hold valid M-Files credentials, and exploitation requires that victim users be actively interacting with M-Files Web. User interaction is part of the exploitation chain, since session tokens are only available while target users have active sessions.

After capturing a token, the attacker replays it through M-Files Web requests to access documents, metadata, and workflows accessible to the impersonated account. The attack does not require code execution on the server. Refer to the M-Files Security Advisory CVE-2025-13008 for vendor-specific technical details.

Detection Methods for CVE-2025-13008

Indicators of Compromise

Concurrent M-Files Web sessions for the same user account originating from distinct source IP addresses or user agents.
Authentication or document access events for a user from an unexpected geographic location while the user's primary session remains active.
Sudden spikes in document retrieval or metadata enumeration from a single account within a short time window.

Detection Strategies

Correlate M-Files Web access logs with identity provider logs to identify session reuse across mismatched client fingerprints.
Hunt for repeated API calls referencing distinct session tokens from a single source host, which can indicate token harvesting.
Alert on accounts that exhibit access patterns inconsistent with established baselines, such as off-hours bulk document access.

Monitoring Recommendations

Enable verbose audit logging on M-Files Server and forward logs to a centralized analytics platform for retention and correlation.
Monitor for privileged account activity originating from non-corporate IP ranges or unmanaged endpoints.
Track failed and successful authentication events to detect credential testing that may precede session token capture.

How to Mitigate CVE-2025-13008

Immediate Actions Required

Upgrade M-Files Server to 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, or 24.8 LTS SR5 or later, depending on the deployed branch.
Invalidate all active M-Files Web sessions after patching to force re-authentication and revoke any tokens that may have been captured.
Review M-Files audit logs for evidence of anomalous session use prior to patch application.

Patch Information

M-Files has released fixed builds across supported branches. Administrators should review the M-Files Security Advisory CVE-2025-13008 and apply the appropriate update for their deployment. Upgrade paths include 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3, and 24.8 LTS SR5.

Workarounds

Restrict M-Files Web access to trusted networks using firewall rules or VPN gating until patching is complete.
Reduce session lifetime in M-Files Web configuration to shorten the window in which captured tokens remain valid.
Enforce multi-factor authentication so that re-authentication is required after session anomalies, limiting the value of any stolen token.

bash

# Verify installed M-Files Server version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\Motive\M-Files\*\Server\*" |
  Select-Object DisplayName, DisplayVersion

# Expected post-patch versions (one of):
#   25.12.15491.7
#   25.8 LTS SR3
#   25.2 LTS SR3
#   24.8 LTS SR5