CVE-2026-18372 Overview
CVE-2026-18372 is a Cascading Style Sheets (CSS) injection vulnerability in M-Files Web versions before 26.8.16330.2. An authenticated vault administrator can inject arbitrary CSS that renders in the web user interface presented to other vault users. The flaw is tracked under CWE-79 and affects the client-side rendering layer of the M-Files Web application.
Exploitation requires high privileges and user interaction, which limits the practical attack surface. The impact is confined to integrity effects on the rendered UI, with no direct confidentiality or availability loss to the vault backend.
Critical Impact
An authenticated vault administrator can inject arbitrary CSS into the M-Files Web interface, enabling UI redressing, content spoofing, and phishing directed at other vault users.
Affected Products
- M-Files Web versions prior to 26.8.16330.2
- M-Files vault deployments exposing the web user interface
- Environments where administrative accounts interact with non-administrative vault users
Discovery Timeline
- 2026-08-19 - CVE-2026-18372 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-18372
Vulnerability Analysis
The vulnerability resides in the M-Files Web interface, which fails to properly sanitize administrator-supplied content before rendering it as CSS in the browsers of other vault users. Under CWE-79, the flaw covers improper neutralization of input during web page generation. CSS injection is a client-side attack class that manipulates the presentation layer rather than executing arbitrary script.
An attacker with vault administrator credentials injects styling rules that alter the appearance of the vault UI for other users. These rules can hide legitimate content, overlay attacker-controlled elements, or exfiltrate limited data through selector-based side channels such as attribute selectors combined with background image requests. The Exploit Prediction Scoring System (EPSS) probability of 0.309% reflects a low likelihood of observed exploitation activity in the near term.
Root Cause
The root cause is missing or insufficient sanitization of input that is later reflected into style contexts within the M-Files Web interface. When administrator-supplied values flow into CSS output without neutralization of style-breaking characters, an attacker controls arbitrary style declarations rendered to other users.
Attack Vector
The attack requires network access to the M-Files Web endpoint and an authenticated administrator session. The attacker stores malicious CSS in a field that is later rendered to other vault users. Exploitation completes when a victim views the affected UI, satisfying the user interaction requirement.
See the M-Files Security Advisory CVE-2026-18372 for vendor-supplied technical details.
Detection Methods for CVE-2026-18372
Indicators of Compromise
- Unexpected CSS declarations, @import rules, or url() references stored in vault metadata, object properties, or configuration fields editable by administrators.
- Outbound HTTP requests from user browsers to unfamiliar domains triggered by CSS background, content, or @font-face directives.
- User reports of visually altered or misleading elements in the M-Files Web UI, including hidden buttons or spoofed dialogs.
Detection Strategies
- Audit vault administrator activity logs for edits to fields that render into the web UI, correlating changes with subsequent user-reported UI anomalies.
- Scan stored vault content for CSS syntax patterns such as expression(, @import, url(, and position:fixed in fields not expected to contain styling.
- Compare rendered HTML and CSS payloads served by the M-Files Web application against a known-good baseline to identify unauthorized style rules.
Monitoring Recommendations
- Log and review all administrative changes to vault metadata schemas and UI-facing configuration in a centralized SIEM.
- Monitor egress traffic from client workstations for connections to domains referenced only within vault content.
- Alert on newly created or modified administrator accounts in M-Files, since this vulnerability requires administrative privileges.
How to Mitigate CVE-2026-18372
Immediate Actions Required
- Upgrade M-Files Web to version 26.8.16330.2 or later as specified in the vendor advisory.
- Review the list of accounts holding vault administrator privileges and revoke access that is not strictly required.
- Inspect vault content for pre-existing CSS payloads inserted before the upgrade and remove any unauthorized style declarations.
Patch Information
M-Files has released a fixed build in version 26.8.16330.2. Consult the M-Files Security Advisory CVE-2026-18372 for full patch guidance and release notes.
Workarounds
- Restrict vault administrator role assignments to a minimal set of trusted operators until the patch is deployed.
- Enforce multi-factor authentication on all administrative accounts to reduce the risk of credential compromise leading to CSS injection.
- Educate vault users to report any unexpected visual changes in the M-Files Web interface so injected styling is identified quickly.
# Verify installed M-Files Web version meets the fixed release
# Replace the path below with the actual installation path in your environment
Get-ItemProperty "C:\Program Files\M-Files\*\Web\*.dll" | Select-Object Name, VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
