This vulnerability in M-Files Web is an HTML injection issue where insufficient input neutralization allows an authenticated attacker to inject HTML into the web interface displayed to other users. The flaw affects versions prior to 26.8.16330.2. The CVSS 4.0 score is 5.1, reflecting network attack vector, low attack complexity, no attack vector privileges required beyond authentication, and partial impact on integrity and availability. No official patch or remediation level has been disclosed by the vendor yet, and no known exploits are reported in the wild.

An authenticated attacker with limited privileges can inject HTML content into the web interface, potentially altering the user interface for other users. This could lead to user confusion or manipulation of displayed content, but there is no indication of direct code execution or data exfiltration. The impact is limited to integrity and availability with low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit authenticated user privileges to trusted users only and monitor for suspicious activity related to UI manipulation.