CVE-2023-5524 HIGH

CVE-2023-5524: M-Files Web Companion allows Remote Code Execution for some filetypes

Vendor M-Files

Product Web Companion

Weakness CWE-434 · Unrestricted file upload

Published October 20, 2023

Last update February 23, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types

Key dates

02Disclosure timeline

October 20, 2023 CVE published

February 23, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-5524 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-56052 WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability CVE-2025-8171 code-projects Document Management System insert.php unrestricted upload CVE-2024-48035 WordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerability CVE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist CVE-2026-34735 Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController`