CVE-2025-5964: M-Files Server Path Traversal Vulnerability

CVE-2025-5964 Overview

CVE-2025-5964 is a path traversal vulnerability [CWE-22] in the M-Files Server API endpoint. The flaw affects M-Files Server versions before 25.6.14925.0 and allows an authenticated user to read arbitrary files on the server host. M-Files is a document management and enterprise information management platform used to store sensitive corporate data. The vulnerability requires only low-privileged authentication and no user interaction. Successful exploitation exposes files outside the intended API scope, including configuration files, credentials, and business documents stored on the underlying operating system.

Critical Impact
An authenticated attacker can read arbitrary files on the M-Files Server host over the network, exposing sensitive configuration data, credentials, and stored documents.

Affected Products

M-Files Server versions prior to 25.6.14925.0
M-Files Server LTS branches prior to the fixed release
M-Files Server current (non-LTS) branches prior to the fixed release

Discovery Timeline

2025-06-15 - CVE-2025-5964 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5964

Vulnerability Analysis

The vulnerability resides in an API endpoint exposed by M-Files Server. The endpoint accepts a file path parameter and fails to canonicalize or validate the input against an allow-listed directory. An authenticated user can supply traversal sequences to escape the intended base path and reference files elsewhere on the file system.

Because M-Files Server typically runs with elevated privileges to access vault storage and system resources, the disclosure surface can extend to sensitive artifacts including server configuration, vault database connection strings, application secrets, and Windows system files readable by the service account.

The EPSS score of approximately 14.3% (96.4 percentile) reflects meaningful exploitation likelihood relative to the broader CVE population. Only low-privileged authentication is required, which raises the risk in environments where internal users, contractors, or federated identities can obtain M-Files credentials.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected API handler concatenates user-controlled input into a file path without normalizing traversal sequences such as ../ or absolute path overrides. The handler then reads the resolved path and returns file contents to the caller.

Attack Vector

An attacker authenticates to M-Files Server with any valid low-privileged account. The attacker then issues a crafted HTTP request to the vulnerable API endpoint containing directory traversal sequences in the file path parameter. The server resolves the path, reads the target file, and returns its contents in the API response. No user interaction is required and the attack is fully remote over the network.

See the M-Files Security Advisory CVE-2025-5964 for vendor-supplied technical details.

Detection Methods for CVE-2025-5964

Indicators of Compromise

HTTP requests to M-Files Server API endpoints containing traversal sequences such as ../, ..\, %2e%2e%2f, or URL-encoded variants.
API responses returning unexpected file content types or large file payloads to authenticated but low-privileged accounts.
Access to server-local file paths such as C:\Windows\, C:\ProgramData\M-Files\, or M-Files configuration directories in application telemetry.

Detection Strategies

Inspect M-Files Server access and audit logs for API calls that reference unusual path parameters or return unexpected file types.
Deploy web application firewall rules that flag traversal patterns in query strings and JSON bodies targeting M-Files API routes.
Correlate authenticated session activity with file read volume anomalies against per-user baselines.

Monitoring Recommendations

Enable verbose API logging on M-Files Server and forward events to a centralized SIEM for retention and correlation.
Alert on any authenticated account issuing traversal-like payloads, especially from service or low-privilege identities.
Monitor egress from the M-Files Server host for outbound transfer spikes that could indicate bulk file exfiltration after disclosure.

How to Mitigate CVE-2025-5964

Immediate Actions Required

Upgrade M-Files Server to version 25.6.14925.0 or later on both LTS and current branches.
Audit M-Files user accounts and revoke unnecessary or dormant credentials to reduce the pool of accounts that can authenticate to the API.
Review M-Files Server logs for suspicious API requests since the affected versions were first deployed.

Patch Information

M-Files has released a fixed version that addresses the path traversal in the API endpoint. Administrators should install the update per vendor guidance in the M-Files Security Advisory CVE-2025-5964. Verify the running server version after upgrade and confirm the build number is 25.6.14925.0 or later.

Workarounds

Restrict network access to the M-Files Server API to trusted management networks and authenticated VPN clients while patching is scheduled.
Enforce strong authentication and multi-factor authentication for all M-Files accounts to raise the barrier for authenticated exploitation.
Run the M-Files Server service under the least-privileged account that supports vault operations to reduce the scope of files readable through traversal.

bash

# Verify installed M-Files Server version on Windows
reg query "HKLM\SOFTWARE\Motive\M-Files" /v "Installed Version"

# Confirm the reported version is 25.6.14925.0 or later before returning the server to normal exposure