CVE-2023-5523 HIGH

CVE-2023-5523: M-Files Web Companion allows Remote Code Execution

Vendor M-Files

Product Web Companion

Weakness CWE-829 · Inclusion from untrusted sphere

Published October 20, 2023

Last update February 23, 2026

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution

Key dates

02Disclosure timeline

October 20, 2023 CVE published

February 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-5523 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/829.html

Related vulnerabilities

04Related CVE

CVE-2025-59828 Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions CVE-2024-38476 Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect CVE-2026-40959 CVE-2026-32920 OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins CVE-2025-36727 SimpleHelp Inclusion of functionality from untrusted control sphere