CVE-2026-18371: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in M-Files Corporation M-Files Web
CVE-2026-18371 is a medium severity HTML injection vulnerability in M-Files Web before version 26.8.16330.2. It allows an authenticated attacker to inject malicious content into the web user interface seen by other users. This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as cross-site scripting).
AI Analysis
Technical Summary
This vulnerability in M-Files Web versions prior to 26.8.16330.2 enables an authenticated attacker to perform HTML injection, affecting the web user interface content displayed to other users. The flaw arises from improper neutralization of input during web page generation, categorized under CWE-79. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low attack complexity, and requiring privileges and user interaction.
Potential Impact
An authenticated attacker can inject malicious HTML content into the web interface, potentially misleading or manipulating other users who view the affected interface. This could lead to user interface manipulation or limited cross-site scripting effects. There is no indication of remote unauthenticated exploitation or privilege escalation. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in M-Files Web version 26.8.16330.2 and later. Users should upgrade to this version or newer to remediate the vulnerability. No additional mitigation steps are specified by the vendor advisory.
CVE-2026-18371: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in M-Files Corporation M-Files Web
Description
CVE-2026-18371 is a medium severity HTML injection vulnerability in M-Files Web before version 26.8.16330.2. It allows an authenticated attacker to inject malicious content into the web user interface seen by other users. This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as cross-site scripting).
CVSS v4.0
Score 5.1medium
Affected software
M-Files Corporation
M-Files Web
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in M-Files Web versions prior to 26.8.16330.2 enables an authenticated attacker to perform HTML injection, affecting the web user interface content displayed to other users. The flaw arises from improper neutralization of input during web page generation, categorized under CWE-79. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low attack complexity, and requiring privileges and user interaction.
Potential Impact
An authenticated attacker can inject malicious HTML content into the web interface, potentially misleading or manipulating other users who view the affected interface. This could lead to user interface manipulation or limited cross-site scripting effects. There is no indication of remote unauthenticated exploitation or privilege escalation. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in M-Files Web version 26.8.16330.2 and later. Users should upgrade to this version or newer to remediate the vulnerability. No additional mitigation steps are specified by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- M-Files Corporation
- Date Reserved
- 2026-07-30T10:05:35.301Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a859cabacd9273b4909e3ec
Added to database: 08/19/2026, 12:08:11 UTC
Last enriched: 09/11/2026, 09:32:54 UTC
Last updated: 10/02/2026, 09:33:36 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.